Pedro Pinho

SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN

PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API

UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email

Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback

Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure

UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together

Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route

WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions

Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router