HieuPenguinnn Blog

hieupenguinnn@research-lab:~ (zsh)

ARMED & HUNTING v2.6.4-sec

➜ ~ whoami --verbose

[+] Operative: HieuPenguinnn — Web Security Researcher & CTF Player

[+] Affiliations: PTIT | CTF Team W4llz | Patchstack

[+] Primary Focus: Real-world Web Exploitation, WordPress Core/Plugins Vulnerability Research

➜ ~ cat status.json

{
  "status": "HUNTING_VULNERABILITIES",
  "target_surface": ["WordPress Plugins", "Open-Source Apps", "IDOR & BAC", "SSRF / SQLi"],
  "telemetry": {
    "cve_disclosed": 294,
    "ctf_challenges_solved": 39,
    "total_research_logs": 49
  }
}

Patchstack Profile GitHub > About Researcher

➜ ~ listening for zero-days

Vulnerability Advisories CVE

View all (294)

2026.08.27

CVE-2026-78259

WPLegalPages API Secret Disclosure and Account Disconnect via Unauthenticated REST API

Unauthenticated WPLegalPages <= 3.6.4 REST endpoints disclose API secrets and allow attackers to disconnect the connected account.

Read Advisory SECREPORT

#CVE #WordPress #Information Disclosure #Broken Access Control

2026.07.30

CVE-2026-59557

Events Made Easy Arbitrary Person Record Modification Without Login

Broken access control in Events Made Easy <= 3.0.67 lets unauthenticated attackers modify arbitrary person records through the public personal-information AJAX endpoint.

Read Advisory SECREPORT

#CVE #WordPress #Broken Access Control #IDOR

2026.07.28

CVE-2026-61948

Unauthenticated SQL Injection in Mini Cart Coupon REST Endpoint

Unauthenticated SQL injection in WPDM Premium Packages <= 6.2.0 exposes the public Mini Cart coupon REST endpoint to blind time-based database extraction.

Read Advisory SECREPORT

#CVE #WordPress #SQL Injection

2026.07.27

CVE-2026-57408

Peach Payments Gateway Payment Status Forgery via Unauthenticated Webhook

Unauthenticated webhook forgery in Peach Payments Gateway <= 4.0.2 lets attackers mark pending WooCommerce orders as paid by submitting a forged successful payment result.

Read Advisory SECREPORT

#CVE #WordPress #Webhook Forgery #Payment Bypass