Michelle Porter

Michelle Porter is a security researcher credited with 9 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #495 of 3,515 contributors. Their disclosures were published between 2024 and 2025. The most productive year was 2025, with 5 findings.

Their research concentrates on Missing Authorization, which accounts for 4 of their findings (44%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 5.4, peaking at 8.8. Severity breakdown: 0 critical and 2 high.

The most affected software includes ImagePress (2), Academy LMS (1), Academy LMS Pro (1), across 8 distinct plugins, themes and core versions in total.

8 of the 9 disclosed issues have a vendor fix, while 1 remain unpatched. The most severe finding, "WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover", scores 8.8 out of 10.

20242025

Critical

High

Medium

Low

Global Rank

#495

of 3,515 researchers

Vulns

Critical0

High2

Medium7

Low0

Affected Assets

9plugins

Avg CVSS

5.4

Average score of vulnerabilities

Researcher Submissions

9 records


2025-11-20 00:00	ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal ELEX WordPress HelpDesk & Customer… <= 3.3.1	`CVE-2025-10054`	4.3 Medium	Michelle Porter	Yes
2025-11-07 00:00	Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses' Academy LMS <= 3.3.8	`CVE-2025-12099`	7.2 High	Michelle Porter	Yes
2025-11-07 00:00	Academy LMS Pro <= 3.3.8 - Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script' Academy LMS Pro <= 3.3.8	`CVE-2025-12098`	5.3 Medium	Michelle Porter	Yes
2025-09-09 17:42	WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover WPGYM - Wordpress Gym Management System <= 67.7.0	`CVE-2025-7049`	8.8 High	Michelle Porter	No
2025-04-07 00:00	MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion MelaPress Login Security Premium 2.1.0	`CVE-2025-2876`	5.3 Medium	Michelle Porter	Yes
2024-10-11 00:00	ImagePress – Image Gallery <= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update ImagePress <= 1.2.2	`CVE-2024-9778`	4.3 Medium	Michelle Porter	Yes
2024-10-11 00:00	ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update ImagePress <= 1.2.2	`CVE-2024-9824`	4.3 Medium	Michelle Porter	Yes
2024-09-27 00:00	WP MultiTasking - WP Utilities <= 0.1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting WP MultiTasking <= 0.1.17	`CVE-2024-8189`	4.4 Medium	Michelle Porter	Yes
2024-09-25 00:00	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure Email Subscribers & Newsletters <= 5.7.34	`CVE-2024-8771`	4.3 Medium	Michelle Porter	Yes

Showing 1–9 of 9 reports