Muhan Luo

Muhan Luo is a security researcher credited with 7 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #633 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 6 findings.

Their research concentrates on Missing Authorization, which accounts for 4 of their findings (57%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Cross-Site Scripting. The average CVSS score across these disclosures is 4.5, peaking at 5.4.

The most affected software includes Colissimo shipping methods… (1), DHL eCommerce (Benelux) for WooCommerce (1), JTL-Connector for WooCommerce (1), across 7 distinct plugins, themes and core versions in total.

5 of the 7 disclosed issues have a vendor fix, while 2 remain unpatched.

20252026

Critical

High

Medium

Low

Global Rank

#633

of 3,515 researchers

Vulns

Critical0

High0

Medium7

Low0

Affected Assets

7plugins

Avg CVSS

4.5

Average score of vulnerabilities

Researcher Submissions

7 records


2026-08-10 00:00	Payment Forms for Paystack <= 4.0.5 - Authenticated (Subscriber+) Information Exposure Payment Forms for Paystack <= 4.0.5	`CVE-2026-66444`	4.3 Medium	Muhan Luo	No
2026-07-08 20:45	DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions DHL eCommerce (Benelux) for WooCommerce <= 2.2.3	`CVE-2026-9235`	4.3 Medium	Muhan Luo	Yes
2026-07-08 20:39	Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action Colissimo shipping methods… <= 2.9.0	`CVE-2026-9240`	4.3 Medium	Muhan Luo	Yes
2026-06-01 19:43	JTL-Connector for WooCommerce <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions JTL-Connector for WooCommerce <= 2.4.1	`CVE-2026-9234`	4.3 Medium	Muhan Luo	No
2026-04-29 00:00	WPPizza – A Restaurant Plugin <= 3.19.9 - Authenticated (Subscriber+) Information Exposure WPPizza <= 3.19.9	`CVE-2026-40796`	4.3 Medium	Muhan Luo	Yes
2026-04-16 00:00	MyRewards <= 5.7.3 - Missing Authorization MyRewards <= 5.7.3	`CVE-2026-40786`	4.3 Medium	Muhan Luo	Yes
2025-07-09 12:30	wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar wpForo Forum <= 2.4.5	`CVE-2025-4406`	5.4 Medium	Muhan Luo	Yes

Showing 1–7 of 7 reports