Mitchell

Mitchell is a security researcher credited with 13 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #395 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Missing Authorization, which accounts for 6 of their findings (46%). Other recurring categories include Cross-Site Scripting, Improper Authorization. The average CVSS score across these disclosures is 6.7, peaking at 9.8. Severity breakdown: 1 critical and 5 high.

The most affected software includes AppMySite (1), Drag and Drop Multiple File Upload… (1), Events Calendar for GeoDirectory (1), across 13 distinct plugins, themes and core versions in total.

All 13 disclosed issues have since received a vendor fix. The most severe finding, "Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#395

of 3,823 researchers

Vulns

Critical1

High5

Medium7

Low0

Affected Assets

13plugins

Avg CVSS

6.7

Average score of vulnerabilities

Researcher Submissions

13 records


2026-09-18 18:48	AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler AppMySite <= 3.15.3	`CVE-2026-13770`	6.4 Medium	Mitchell	Yes
2026-09-17 14:08	RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action RT Mega Menu <= 1.5.1	`CVE-2026-14855`	6.4 Medium	Mitchell	Yes
2026-08-04 18:21	Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API Page and Post Restriction <= 1.4.1	`CVE-2026-12000`	7.5 High	Mitchell	Yes
2026-07-27 00:00	Xendit Payment <= 7.2.0 - Missing Authorization Xendit Payment <= 7.2.0	`CVE-2026-66473`	5.3 Medium	Mitchell	Yes
2026-07-23 00:00	Post My CF7 Form <= 6.2.0 - Missing Authorization Post My CF7 Form <= 6.2.0	`CVE-2026-59534`	5.3 Medium	Mitchell	Yes
2026-07-22 00:00	Ziina <= 1.2.21 - Missing Authorization Ziina <= 1.2.21	`CVE-2026-59554`	5.3 Medium	Mitchell	Yes
2026-07-10 17:34	Wallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action Wallet for WooCommerce <= 1.6.4	`CVE-2026-12103`	4.3 Medium	Mitchell	Yes
2026-07-08 00:00	Stock Locations for WooCommerce <= 3.1.8 - Missing Authorization Stock Locations for WooCommerce <= 3.1.8	`CVE-2026-57419`	4.3 Medium	Mitchell	Yes
2026-07-01 16:53	Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter Request a Quote <= 2.5.5	`CVE-2026-14249`	7.5 High	Mitchell	Yes
2026-06-08 19:02	Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation Events Calendar for GeoDirectory <= 2.3.28	`CVE-2026-11616`	8.8 High	Mitchell	Yes

Showing 1–10 of 13 reports