Legion Hunter

Legion Hunter is a security researcher credited with 286 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #27 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2025, with 155 findings.

Their research concentrates on Missing Authorization, which accounts for 261 of their findings (91%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 5.0, peaking at 8.2. Severity breakdown: 0 critical and 6 high.

The most affected software includes WPLP Cookie Consent (3), Aruba HiSpeed Cache (2), TrueAna (2), across 281 distinct plugins, themes and core versions in total.

199 of the 286 disclosed issues have a vendor fix, while 87 remain unpatched. The most severe finding, "WPFormify <= 1.1.1 - Missing Authorization", scores 8.2 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#27

of 3,515 researchers

Vulns

286

Critical0

High6

Medium280

Low0

Affected Assets

291

278plugins13themes

Avg CVSS

5.0

Average score of vulnerabilities

Researcher Submissions

286 records


2026-09-08 17:19	ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function ilGhera Reviso Exporter for WooCommerce <= 1.2.3	`CVE-2026-8615`	4.3 Medium	Legion Hunter	Yes
2026-08-10 00:00	iCARRY <= 2.9 - Unauthenticated Information Exposure iCARRY <= 2.9	`CVE-2026-66463`	5.3 Medium	Legion Hunter	No
2026-08-10 00:00	Website Internal Link Optimiser <= 5.2.7 - Missing Authorization Website Internal Link Optimiser <= 5.2.7	`CVE-2026-66464`	5.3 Medium	Legion Hunter	No
2026-08-04 18:30	Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action Udimi Tools <= 3.2	`CVE-2026-7456`	6.5 Medium	Legion Hunter	Yes
2026-08-04 18:19	WPFormify <= 1.1.1 - Missing Authorization WPFormify <= 1.1.1	`CVE-2026-6627`	8.2 High	Legion Hunter	Yes
2026-08-04 17:32	wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API wiseCampaign <= 1.1.16	`CVE-2026-7529`	7.5 High	Legion Hunter	Yes
2026-07-28 00:00	Staff Training <= 1.0.7 - Missing Authorization Staff Training <= 1.0.7	`CVE-2026-65541`	5.3 Medium	Legion Hunter	No
2026-07-22 00:00	Participants Database <= 2.7.8.4 - Missing Authorization Participants Database <= 2.7.8.4	`CVE-2026-27423`	4.3 Medium	Legion Hunter	Yes
2026-07-22 00:00	Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.66 - Missing Authorization Ditty <= 3.1.66	`CVE-2026-27355`	5.3 Medium	Legion Hunter	Yes
2026-07-21 00:00	MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.40 - Missing Authorization MarketKing <= 2.1.40	`CVE-2026-27399`	5.3 Medium	Legion Hunter	Yes

Showing 1–10 of 250 reports

Showing the 250 most recent of 286 records. Every record has its own page and is listed in the sitemap.