HayMiz

HayMiz is a security researcher credited with 13 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #367 of 3,515 contributors. Their disclosures were published between 2024 and 2025. The most productive year was 2025, with 12 findings.

Their research concentrates on Deserialization Of Untrusted Data, which accounts for 3 of their findings (23%). Other recurring categories include External Control Of File Name Or Path, Path Traversal. The average CVSS score across these disclosures is 5.6, peaking at 7.6. Severity breakdown: 0 critical and 6 high.

The most affected software includes Export and Import Users and Customers (4), Order Export & Order Import… (4), Product Import Export for WooCommerce (4), across 4 distinct plugins, themes and core versions in total.

All 13 disclosed issues have since received a vendor fix.

20242025

Critical

High

Medium

Low

Global Rank

#367

of 3,515 researchers

Vulns

Critical0

High6

Medium4

Low3

Affected Assets

4plugins

Avg CVSS

5.6

Average score of vulnerabilities

Researcher Submissions

13 records


2025-03-25 23:23	Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter Product Import Export for WooCommerce <= 2.5.0	`CVE-2025-1913`	7.2 High	HayMiz	Yes
2025-03-25 23:22	Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function Product Import Export for WooCommerce <= 2.5.0	`CVE-2025-1912`	7.6 High	HayMiz	Yes
2025-03-25 23:22	Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function Product Import Export for WooCommerce <= 2.5.0	`CVE-2025-1911`	2.7 Low	HayMiz	Yes
2025-03-25 23:20	Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function Product Import Export for WooCommerce <= 2.5.0	`CVE-2025-1769`	4.9 Medium	HayMiz	Yes
2025-03-21 23:19	Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function Export and Import Users and Customers <= 2.6.2	`CVE-2025-1973`	4.9 Medium	HayMiz	Yes
2025-03-21 23:18	Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function Export and Import Users and Customers <= 2.6.2	`CVE-2025-1972`	2.7 Low	HayMiz	Yes
2025-03-21 23:17	Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter Export and Import Users and Customers <= 2.6.2	`CVE-2025-1971`	7.2 High	HayMiz	Yes
2025-03-21 23:15	Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function Export and Import Users and Customers <= 2.6.2	`CVE-2025-1970`	7.6 High	HayMiz	Yes
2025-03-19 22:29	Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function Order Export & Order Import… <= 2.6.0	`CVE-2024-13920`	4.9 Medium	HayMiz	Yes
2025-03-19 22:28	Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter Order Export & Order Import… <= 2.6.0	`CVE-2024-13921`	7.2 High	HayMiz	Yes

Showing 1–10 of 13 reports