KEVIN LEE (crattack)

KEVIN LEE (crattack) is a security researcher credited with 4 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #897 of 3,333 contributors. The disclosure was published in 2026.

Their research concentrates on Authorization Bypass Through User-Controlled Key, which accounts for 1 of their findings (25%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor. The average CVSS score across these disclosures is 5.4, peaking at 7.5. Severity breakdown: 0 critical and 1 high.

The most affected software includes Contact Form Extender for Divi (1), Klamra Paycal for Aspaclaria (1), Passeum Ticketing (1), across 4 distinct plugins, themes and core versions in total.

2 of the 4 disclosed issues have a vendor fix, while 2 remain unpatched.

2026

Critical

High

Medium

Low

Global Rank

#897

of 3,333 researchers

Vulns

Critical0

High1

Medium3

Low0

Affected Assets

4plugins

Avg CVSS

5.4

Average score of vulnerabilities

Researcher Submissions

4 records


2026-08-04 18:40	Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal Contact Form Extender for Divi <= 1.0.6	`N/A`	7.5 High	KEVIN LEE (crattack)	Yes
2026-06-05 14:28	Klamra Paycal for Aspaclaria <= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameter Klamra Paycal for Aspaclaria <= 1.1.4	`CVE-2026-8611`	4.3 Medium	KEVIN LEE (crattack)	Yes
2026-06-02 10:57	Passeum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting Passeum Ticketing <= 1.0	`CVE-2026-7421`	4.4 Medium	KEVIN LEE (crattack)	No
2026-05-11 19:06	Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields Slek Gateway for WooCommerce <= 1.0	`CVE-2026-7626`	5.3 Medium	KEVIN LEE (crattack)	No

Showing 1–4 of 4 reports