You’ve been hacked!
Ahh, no. This is a different kind of news – quite the opposite, actually. 😃
As soon as I got my weekends back during the summer (before the academic year started again), I had an idea: what if I created a vulnerability scanner tailored specifically and exclusively for the WordPress ecosystem?
I liked the idea so much that my two-days-a-week project quickly turned into a 24/7 endeavor. It’s a passion I picked up again after keeping it on pause for over 12 years (life happens).
I didn’t want to build just another traditional tool. So, I built an application that combines static code analysis (using Python and Docker) with Artificial Intelligence to triage the results – an approach that effectively filters out the noise and identifies real vulnerabilities in the code.
Fast forward: a few months since I started playing around with this project, I got not one, but my first two official vulnerabilities assigned to my name as a Security Researcher: CVE-2026-82184 and CVE-2026-96897. I want to take this opportunity to thank WPScan for coordinating the CVEs in their role as a CVE Numbering Authority (CNA).
One of them affected a well-known GDPR compliance WordPress plugin. The vulnerability allowed an unauthenticated user to partially overwrite the plugin’s settings directly in the database.
I keep working on extending the engine’s detection capabilities, constantly scanning the official wp.org plugin repository. I am hunting down hidden vulnerabilities with one single goal: to report them and ensure they are patched before an attacker can exploit them. This proprietary technology has also become a core pillar of my WordPress security audit services, allowing me to protect websites at a much deeper level than commercial scanners do.
Through this project and the web consulting sessions I provide for building secure architectures, I hope to contribute to a safer open-source and WordPress ecosystem for everyone.