Thomas Sanzey

Thomas Sanzey is a security researcher credited with 5 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #736 of 3,515 contributors. Their disclosures were published between 2023 and 2026. The most productive year was 2026, with 3 findings.

Their research concentrates on Unrestricted Upload Of File With Dangerous Type, which accounts for 2 of their findings (40%). Other recurring categories include Cross-Site Scripting, Path Traversal. The average CVSS score across these disclosures is 7.3, peaking at 8.1. Severity breakdown: 0 critical and 4 high.

The most affected software includes Contest Gallery (1), Drag and Drop File Upload for Contact… (1), Drag and Drop Multiple File Upload… (1), across 5 distinct plugins, themes and core versions in total.

All 5 disclosed issues have since received a vendor fix. The most severe finding, "Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass", scores 8.1 out of 10.