🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Wordfence Intelligence > Vulnerability Researchers > Rafie Muhammad

Rafie Muhammad

Organization: Patchstack

All Time Ranking

559

All Time Discoveries

90 Day Published Submissions

N/A

Last Published Submission

Showing 41-60 of 559 Vulnerabilities

WooCommerce Tranzila Gateway <= 1.0.8 - Unauthenticated PHP Object Injection

9.8

CVE-2023-52218

Jan 5, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Taggbox <= 3.1 - Unauthenticated PHP Object Injection

9.8

CVE-2023-52225

Jan 5, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Theme per user <= 1.0.1 - Unauthenticated PHP Object Injection

9.8

CVE-2023-52181

Dec 29, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Frontend Admin by DynamiApps Plugin <= 3.18.3 - Unauthenticated Arbitrary File Upload

9.8

CVE-2023-51411

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

BERTHA AI Plugin <= 1.11.10.7 - Unauthenticated Arbitrary File Upload

9.8

CVE-2023-51419

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Piotnet Forms Plugin <= 1.0.28 - Unauthenticated Arbitrary File Upload

9.8

CVE-2023-51412

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Build App Online <= 1.0.21 - Authentication Bypass via Header

9.8

CVE-2023-51478

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Checkout Mestres WP <= 7.1.9.6 - Authentication Bypass via Password Reset

9.8

CVE-2023-51472

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Checkout Mestres WP <= 7.1.9.6 - Missing Authorization to Unauthenticated Arbitrary Options Update

9.8

CVE-2023-51471

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Rencontre – Dating Site <= 3.10.1 - Privilege Escalation

9.8

CVE-2023-51425

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Checkout Mestres WP <= 7.1.9.6 - Unauthenticated SQL Injection

9.8

CVE-2023-51469

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TerraClassifieds <= 2.0.3 Unauthenticated Arbitrary File Upload

9.8

CVE-2023-51473

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8

CVE-2023-51484

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Rencontre – Dating Site <= 3.10.1 - Unauthenticated Arbitrary File Upload

9.8

CVE-2023-51468

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WebinarIgnition <= 3.05.0 - Missing Authorization to Unauthenticated Privilege Escalation

9.8

CVE-2023-51424

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WebinarIgnition <= 3.05.0 - Unauthenticated SQL Injection

9.8

CVE-2023-51423

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WP Frontend Profile <= 1.3.1 - Unauthenticated Privilege Escalation

9.8

CVE-2023-51483

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WP MLM Unilevel <= 4.0 - Unauthenticated Privilege Escalation

9.8

CVE-2023-51476

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WP MLM <= 4.0 - Unauthenticated Arbitrary File Upload

9.8

CVE-2023-51475

Dec 27, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

BCorp Shortcodes <= 0.23 - Unauthenticated PHP Object Injection

9.8

CVE-2023-49773

Dec 5, 2023

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Title	CVE ID	CVSS	Vector	Date
WooCommerce Tranzila Gateway <= 1.0.8 - Unauthenticated PHP Object Injection	CVE-2023-52218	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	January 5, 2024
Taggbox <= 3.1 - Unauthenticated PHP Object Injection	CVE-2023-52225	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	January 5, 2024
Theme per user <= 1.0.1 - Unauthenticated PHP Object Injection	CVE-2023-52181	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 29, 2023
Frontend Admin by DynamiApps Plugin <= 3.18.3 - Unauthenticated Arbitrary File Upload	CVE-2023-51411	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
BERTHA AI Plugin <= 1.11.10.7 - Unauthenticated Arbitrary File Upload	CVE-2023-51419	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
Piotnet Forms Plugin <= 1.0.28 - Unauthenticated Arbitrary File Upload	CVE-2023-51412	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
Build App Online <= 1.0.21 - Authentication Bypass via Header	CVE-2023-51478	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
Checkout Mestres WP <= 7.1.9.6 - Authentication Bypass via Password Reset	CVE-2023-51472	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
Checkout Mestres WP <= 7.1.9.6 - Missing Authorization to Unauthenticated Arbitrary Options Update	CVE-2023-51471	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
Rencontre – Dating Site <= 3.10.1 - Privilege Escalation	CVE-2023-51425	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
Checkout Mestres WP <= 7.1.9.6 - Unauthenticated SQL Injection	CVE-2023-51469	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
TerraClassifieds <= 2.0.3 Unauthenticated Arbitrary File Upload	CVE-2023-51473	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
Login as User or Customer (User Switching) <= 3.8 - Authentication Bypass	CVE-2023-51484	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
Rencontre – Dating Site <= 3.10.1 - Unauthenticated Arbitrary File Upload	CVE-2023-51468	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
WebinarIgnition <= 3.05.0 - Missing Authorization to Unauthenticated Privilege Escalation	CVE-2023-51424	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
WebinarIgnition <= 3.05.0 - Unauthenticated SQL Injection	CVE-2023-51423	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
WP Frontend Profile <= 1.3.1 - Unauthenticated Privilege Escalation	CVE-2023-51483	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
WP MLM Unilevel <= 4.0 - Unauthenticated Privilege Escalation	CVE-2023-51476	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
WP MLM <= 4.0 - Unauthenticated Arbitrary File Upload	CVE-2023-51475	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 27, 2023
BCorp Shortcodes <= 0.23 - Unauthenticated PHP Object Injection	CVE-2023-49773	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	December 5, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation