Usama Arshad

Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF

WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR

WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR

Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint

Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard

WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart

Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes

CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass