Charles Vosburgh

Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification

Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion

Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref

BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes

RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field

WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form

Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin

Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import

Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR

AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools