Muhan Luo

Muhan Luo is a security researcher credited with 8 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #620 of 3,878 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 7 findings.

Their research concentrates on Missing Authorization, which accounts for 5 of their findings (63%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Cross-Site Scripting. The average CVSS score across these disclosures is 4.4, peaking at 5.4.

The most affected software includes Colissimo shipping methods… (1), DHL eCommerce (Benelux) for WooCommerce (1), JTL-Connector for WooCommerce (1), across 8 distinct plugins, themes and core versions in total.

7 of the 8 disclosed issues have a vendor fix, while 1 remain unpatched.

20252026

Critical

High

Medium

Low

Global Rank

#620

of 3,878 researchers

Vulns

Critical0

High0

Medium8

Low0

Affected Assets

8plugins

Avg CVSS

4.4

Average score of vulnerabilities

Researcher Submissions

8 records


2026-09-18 19:59	Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions Partial Shipment for WooCommerce <= 3.4	`CVE-2026-9858`	4.3 Medium	Muhan Luo	Yes
2026-08-10 00:00	Payment Forms for Paystack <= 4.0.5 - Authenticated (Subscriber+) Information Exposure Payment Forms for Paystack <= 4.0.5	`CVE-2026-66444`	4.3 Medium	Muhan Luo	No
2026-07-08 20:45	DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions DHL eCommerce (Benelux) for WooCommerce <= 2.2.3	`CVE-2026-9235`	4.3 Medium	Muhan Luo	Yes
2026-07-08 20:39	Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action Colissimo shipping methods… <= 2.9.0	`CVE-2026-9240`	4.3 Medium	Muhan Luo	Yes
2026-06-01 19:43	JTL-Connector for WooCommerce <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions JTL-Connector for WooCommerce <= 2.4.1	`CVE-2026-9234`	4.3 Medium	Muhan Luo	Yes
2026-04-29 00:00	WPPizza – A Restaurant Plugin <= 3.19.9 - Authenticated (Subscriber+) Information Exposure WPPizza <= 3.19.9	`CVE-2026-40796`	4.3 Medium	Muhan Luo	Yes
2026-04-16 00:00	MyRewards <= 5.7.3 - Missing Authorization MyRewards <= 5.7.3	`CVE-2026-40786`	4.3 Medium	Muhan Luo	Yes
2025-07-09 12:30	wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar wpForo Forum <= 2.4.5	`CVE-2025-4406`	5.4 Medium	Muhan Luo	Yes

Showing 1–8 of 8 reports