Legion Hunter

Legion Hunter is a security researcher credited with 289 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #28 of 3,899 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2025, with 155 findings.

Their research concentrates on Missing Authorization, which accounts for 264 of their findings (91%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 5.0, peaking at 8.2. Severity breakdown: 0 critical and 6 high.

The most affected software includes WPLP Cookie Consent (3), Aruba HiSpeed Cache (2), TrueAna (2), across 284 distinct plugins, themes and core versions in total.

209 of the 289 disclosed issues have a vendor fix, while 80 remain unpatched. The most severe finding, "WPFormify <= 1.1.1 - Missing Authorization", scores 8.2 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#28

of 3,899 researchers

Vulns

289

Critical0

High6

Medium283

Low0

Affected Assets

294

280plugins14themes

Avg CVSS

5.0

Average score of vulnerabilities

Researcher Submissions

289 records


2026-09-23 21:35	Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset Custom Thank You Page for WooCommerce <= 1.1.2	`CVE-2026-4806`	6.5 Medium	Legion Hunter	Yes
2026-09-18 19:03	Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action Ibtana <= 0.4.7.7	`CVE-2026-1984`	5.3 Medium	Legion Hunter	Yes
2026-09-18 00:00	VW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset VW Writer Blog <= 1.3.8	`CVE-2026-2278`	4.3 Medium	Legion Hunter	Yes
2026-09-08 17:19	ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function ilGhera Reviso Exporter for WooCommerce <= 1.2.3	`CVE-2026-8615`	4.3 Medium	Legion Hunter	Yes
2026-08-10 00:00	iCARRY <= 2.9 - Unauthenticated Information Exposure iCARRY <= 2.9	`CVE-2026-66463`	5.3 Medium	Legion Hunter	No
2026-08-10 00:00	Website Internal Link Optimiser <= 5.2.7 - Missing Authorization Website Internal Link Optimiser <= 5.2.7	`CVE-2026-66464`	5.3 Medium	Legion Hunter	No
2026-08-04 18:30	Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action Udimi Tools <= 3.2	`CVE-2026-7456`	6.5 Medium	Legion Hunter	Yes
2026-08-04 18:19	WPFormify <= 1.1.1 - Missing Authorization WPFormify <= 1.1.1	`CVE-2026-6627`	8.2 High	Legion Hunter	Yes
2026-08-04 17:32	wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API wiseCampaign <= 1.1.16	`CVE-2026-7529`	7.5 High	Legion Hunter	Yes
2026-07-28 00:00	Staff Training <= 1.0.7 - Missing Authorization Staff Training <= 1.0.7	`CVE-2026-65541`	5.3 Medium	Legion Hunter	No

Showing 1–10 of 250 reports

Showing the 250 most recent of 289 records. Every record has its own page and is listed in the sitemap.