Sarawut Poolkhet (MisterHelloz)
Sarawut Poolkhet (MisterHelloz) is a security researcher credited with 15 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #328 of 3,515 contributors. Their disclosures were published between 2025 and 2026. The most productive year was 2026, with 13 findings.
Their research concentrates on Missing Authorization, which accounts for 8 of their findings (53%). Other recurring categories include Path Traversal, Cross-Site Request Forgery (CSRF). The average CVSS score across these disclosures is 6.8, peaking at 9.8. Severity breakdown: 1 critical and 6 high.
The most affected software includes Advanced Custom Fields (ACF®) (2), BuddyPress Xprofile Custom Field Types (1), Creator LMS (1), across 14 distinct plugins, themes and core versions in total.
14 of the 15 disclosed issues have a vendor fix, while 1 remain unpatched. The most severe finding, "Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal", scores 9.8 out of 10.
#328
of 3,515 researchers
15
14
6.8
Average score of vulnerabilities
Researcher Submissions
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C