Blog
Thoughts on development, design, and everything in between.
6/27/2026
A Plugin Can Be Current And Still Hand Out Records To Anyone
A fully patched content management system carried a plugin with current releases and twelve findings. The pattern was authorisation: routes that answered before the permission callback ran.
wordpressrest-apiauthorisationpatch-management
5/9/2026WordPress User Enumeration Is Not The Finding, It Is The Multiplier
A tax advisory firm exposed every account slug through its public REST API, shipped no security headers at all, and left the login form without rate limiting.
wordpressrest-apiuser-enumerationcredential-stuffing