Md. Moniruzzaman Prodhan (NomanProdhan)

Md. Moniruzzaman Prodhan (NomanProdhan) is a security researcher credited with 64 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #101 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 42 findings.

Their research concentrates on Missing Authorization, which accounts for 41 of their findings (64%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Exposure Of Sensitive Information To An Unauthorized Actor. The average CVSS score across these disclosures is 5.6, peaking at 9.8. Severity breakdown: 2 critical and 7 high.

The most affected software includes Booking Calendar Contact Form (2), Frontend Post Submission Manager Lite (2), ilGhera Support System for WooCommerce (2), across 59 distinct plugins, themes and core versions in total.

60 of the 64 disclosed issues have a vendor fix, while 4 remain unpatched. The most severe finding, "File Uploader for WooCommerce <= 1.0.3 - Unauthenticated Arbitrary File Upload via add-image-data", scores 9.8 out of 10.

20252026

Critical

High

Medium

Low

Global Rank

#101

of 3,515 researchers

Vulns

Critical2

High7

Medium55

Low0

Affected Assets

59plugins

Avg CVSS

5.6

Average score of vulnerabilities

Researcher Submissions

64 records


2026-08-04 19:34	Easy Post Submission <= 2.3.0 - Missing Authorization Easy Post Submission <= 2.3.0	`CVE-2026-4431`	9.1 Critical	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-08-04 18:26	Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion Material Dashboard <= 1.4.10	`CVE-2026-6079`	7.3 High	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-07-28 21:21	MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion MasterStudy LMS WordPress Plugin <= 3.7.23	`CVE-2026-5060`	6.5 Medium	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-07-28 21:17	Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update Klubraum Membership Request <= 1.1.0	`CVE-2026-4604`	5.3 Medium	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-07-09 19:11	Easy Upload Files During Checkout <= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufdc-delete' Parameter Easy Upload Files During Checkout <= 3.0.1	`CVE-2026-6802`	5.3 Medium	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-07-08 20:53	Employee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action Employee, Leave and Recruitment… <= 1.2.2	`CVE-2026-9237`	4.3 Medium	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-07-01 00:00	Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure Academy LMS <= 3.8.1	`CVE-2026-5348`	5.3 Medium	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-06-05 15:42	Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action Booking Package <= 1.7.16	`CVE-2026-9851`	7.2 High	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-05-21 19:07	Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action Ditty <= 3.1.65	`CVE-2026-9011`	7.5 High	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-05-12 17:11	ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure ilGhera Support System for WooCommerce <= 1.3.0	`CVE-2025-14033`	5.3 Medium	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes

Showing 1–10 of 64 reports