Phat RiO

Phat RiO is a security researcher credited with 372 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #21 of 3,899 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2025, with 196 findings.

Their research concentrates on Missing Authorization, which accounts for 124 of their findings (33%). Other recurring categories include Deserialization Of Untrusted Data, Improper Control Of Filename For Include/Require Statement In PHP Program. The average CVSS score across these disclosures is 6.8, peaking at 9.8. Severity breakdown: 42 critical and 148 high.

The most affected software includes Directory Listings WordPress plugin (7), The Grid (4), WeDesignTech Ultimate Booking Addon (4), across 307 distinct plugins, themes and core versions in total.

203 of the 372 disclosed issues have a vendor fix, while 169 remain unpatched. The most severe finding, "Zombify <= 1.7.7 - Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.