Tin Pham (TF1T)

Tin Pham (TF1T) is a security researcher credited with 6 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #684 of 3,823 contributors. The disclosure was published in 2026.

Their research concentrates on Unrestricted Upload Of File With Dangerous Type, which accounts for 2 of their findings (33%). Other recurring categories include Cross-Site Scripting, Injection. The average CVSS score across these disclosures is 9.0, peaking at 9.8. Severity breakdown: 4 critical and 2 high.

The most affected software includes Advanced Custom Fields (1), Avada (Fusion) Builder (1), Elementor Website Builder Pro (1), across 6 distinct plugins, themes and core versions in total.

All 6 disclosed issues have since received a vendor fix. The most severe finding, "Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#684

of 3,823 researchers

Vulns

Critical4

High2

Medium0

Low0

Affected Assets

5plugins1core version

Avg CVSS

9.0

Average score of vulnerabilities

Researcher Submissions

6 records


2026-09-23 20:34	Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter Visual Composer Website Builder <= 45.16.0	`CVE-2026-12227`	9.8 Critical	Tin Pham (TF1T)	Yes
2026-09-14 00:00	Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type Advanced Custom Fields <= 0.9.2.6	`N/A`	9.8 Critical	Tin Pham (TF1T)	Yes
2026-08-27 00:00	WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint WP Rocket <= 3.21.0.1	`CVE-2026-5934`	7.2 High	Tin Pham (TF1T)	Yes
2026-08-19 19:18	Elementor Pro <= 4.2.1 - Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass Elementor Website Builder Pro <= 4.2.1	`CVE-2026-32475`	9.8 Critical	Tin Pham (TF1T)	Yes
2026-07-17 00:00	WordPress Core 6.8 - 7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter WordPress 7.0 6.8 – < 7.0.2 · 3 branches	`CVE-2026-60137`	7.5 High	Tin Pham (TF1T)	Yes
2026-05-20 15:45	Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler Avada (Fusion) Builder <= 3.15.2	`CVE-2026-6279`	9.8 Critical	Tin Pham (TF1T)	Yes

Showing 1–6 of 6 reports