Theodoros Malachias

Theodoros Malachias is a security researcher credited with 6 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #661 of 3,515 contributors. Their disclosures were published between 2023 and 2025. The most productive year was 2023, with 5 findings.

Their research concentrates on Cross-Site Request Forgery (CSRF), which accounts for 2 of their findings (33%). Other recurring categories include Deserialization Of Untrusted Data, External Control Of File Name Or Path. The average CVSS score across these disclosures is 6.6, peaking at 8.8. Severity breakdown: 0 critical and 2 high.

The most affected software includes Dokan: AI Powered WooCommerce… (1), Fluent Booking (1), Ninja Forms (1), across 6 distinct plugins, themes and core versions in total.

All 6 disclosed issues have since received a vendor fix. The most severe finding, "Webpushr <= 4.34.0 - Cross-Site Request Forgery to Local File Inclusion via menu", scores 8.8 out of 10.