Patchstack

Patchstack is a security researcher credited with 10 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #435 of 3,515 contributors. Their disclosures were published between 2019 and 2023. The most productive year was 2023, with 5 findings.

Their research concentrates on Missing Authorization, which accounts for 7 of their findings (70%). Other recurring categories include Cross-Site Request Forgery (CSRF), SQL Injection. The average CVSS score across these disclosures is 7.2, peaking at 9.8. Severity breakdown: 1 critical and 3 high.

The most affected software includes MailerLite (2), MainWP Article Uploader Extension (2), Discount Rules for WooCommerce (1), across 8 distinct plugins, themes and core versions in total.

All 10 disclosed issues have since received a vendor fix. The most severe finding, "MailerLite Signup Forms < 1.4.4 - Unauthenticated SQL Injection", scores 9.8 out of 10.

20192020202120222023

Critical

High

Medium

Low

Global Rank

#435

of 3,515 researchers

Vulns

Critical1

High3

Medium6

Low0

Affected Assets

25plugins

Avg CVSS

7.2

Average score of vulnerabilities

Researcher Submissions

10 records


2023-01-18 00:00	MainWP (Various Extensions) - Authenticated (Subscriber+) Arbitrary File Deletion MainWP Article Uploader Extension <= 4.0.2	`N/A`	8.1 High	Patchstack	Yes
2023-01-18 00:00	MainWP (Various Extensions) - Authenticated (Subscriber+) Arbitrary Plugin Installation MainWP Favorites Extension <= 4.0.10	`N/A`	6.5 Medium	Patchstack	Yes
2023-01-18 00:00	MainWP UpdraftPlus Extension <= 4.0.6 - Missing Authorization MainWP UpdraftPlus Extension <= 4.0.6	`N/A`	6.5 Medium	Patchstack	Yes
2023-01-18 00:00	MainWP (Various extensions) - Cross-Site Request Forgery MainWP Wordfence Extension <= 4.0.7	`N/A`	8.8 High	Patchstack	Yes
2023-01-18 00:00	MainWP (Various extensions) - Missing Authorization to Arbitrary Page/Post Deletion MainWP Article Uploader Extension 4.0.2	`N/A`	8.1 High	Patchstack	Yes
2021-01-28 00:00	Popup Builder <= 3.72 Missing Authorization on AJAX actions Popup Builder <= 3.71	`N/A`	6.3 Medium	Patchstack	Yes
2020-08-20 00:00	Discount Rules for WooCommerce <= 2.0.2 - Missing Authorization Discount Rules for WooCommerce <= 2.0.2	`CVE-2020-36834`	6.3 Medium	Patchstack	Yes
2020-05-22 00:00	MailerLite Signup Forms < 1.4.4 - Unauthenticated SQL Injection MailerLite < 1.4.4	`N/A`	9.8 Critical	Patchstack	Yes
2020-05-22 00:00	MailerLite – Signup forms <= 1.4.4 - Cross-Site Request Forgery MailerLite < 1.4.5	`N/A`	5.4 Medium	Patchstack	Yes
2019-08-07 00:00	File Manager <= 4.8 - Missing Authorization on AJAX Actions File Manager <= 4.8	`N/A`	6.3 Medium	Patchstack	Yes

Showing 1–10 of 10 reports