Farid Narimanov

Farid Narimanov is a security researcher credited with 34 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #186 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Missing Authorization, which accounts for 10 of their findings (29%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Authorization Bypass Through User-Controlled Key. The average CVSS score across these disclosures is 5.1, peaking at 9.8. Severity breakdown: 1 critical and 1 high.

The most affected software includes Premium Packages (2), Rox Appointment Booking (2), Stripe Payment Forms by WP Full Pay (2), across 29 distinct plugins, themes and core versions in total.

All 34 disclosed issues have since received a vendor fix. The most severe finding, "Product Input Fields for WooCommerce <= 2.0.1 - Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#186

of 3,823 researchers

Vulns

Critical1

High1

Medium31

Low1

Affected Assets

29plugins

Avg CVSS

5.1

Average score of vulnerabilities

Researcher Submissions

34 records


2026-10-14 00:00	NEX-Forms – Ultimate Forms Plugin for WordPress 9.2.1 - 9.3.0 - Unauthenticated Insecure Direct Object Reference NEX-Forms 9.2.1 – 9.3.0	`CVE-2026-106166`	5.3 Medium	Farid Narimanov	Yes
2026-09-21 00:00	Premium Packages <= 7.2.0 - Unauthenticated Forged Payment and Subscription Events Premium Packages <= 7.2.0	`CVE-2026-93511`	5.3 Medium	Farid Narimanov	Yes
2026-09-21 00:00	WC Fields Factory <= 4.1.10 - Missing Authorization WC Fields Factory <= 4.1.10	`CVE-2026-93508`	4.3 Medium	Farid Narimanov	Yes
2026-09-21 00:00	WC Fields Factory <= 4.1.10 - Missing Authorization WC Fields Factory <= 4.1.10	`CVE-2026-93507`	4.3 Medium	Farid Narimanov	Yes
2026-09-21 00:00	Points and Rewards for WooCommerce <= 2.10.3 - Missing Authorization Points and Rewards for WooCommerce <= 2.10.3	`CVE-2026-93510`	4.3 Medium	Farid Narimanov	Yes
2026-09-16 00:00	Bookit <= 2.6.0.4 - Authenticated (Bookit Staff+) Information Exposure Bookit <= 2.6.0.4	`CVE-2026-89008`	4.3 Medium	Farid Narimanov	Yes
2026-09-14 00:00	MultiVendorX <= 5.0.15 - Missing Authorization MultiVendorX <= 5.0.15	`CVE-2026-74926`	4.3 Medium	Farid Narimanov	Yes
2026-09-14 00:00	Rox Appointment Booking <= 1.2.7 - Unauthenticated Information Exposure Rox Appointment Booking <= 1.2.7	`CVE-2026-87907`	5.3 Medium	Farid Narimanov	Yes
2026-09-12 00:00	Rox Appointment Booking – Appointment Booking Scheduling Solution 1.0.9 - 1.2.2 - Unauthenticated Insecure Direct Object Reference Rox Appointment Booking 1.0.9 – 1.2.2	`CVE-2026-87894`	5.3 Medium	Farid Narimanov	Yes
2026-09-07 00:00	Orbit Fox <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Orbit Fox <= 3.0.8	`CVE-2026-85418`	6.4 Medium	Farid Narimanov	Yes

Showing 1–10 of 34 reports