The Bug Hunter

About

I’m awhacken. I hunt web application and API bugs on HackerOne and YesWeHack, and I’m a member of the Synack Red Team. When a finding can be made public, I write it up here.

Right now: 4 resolved reports on HackerOne; 46 reports on YesWeHack, ranked 582.

CVEs

  • CVE-2026-7051. Blog2Social (8.9.0 and earlier): missing authorization lets any logged-in user delete other users’ post records. Medium, CVSS 5.4. Wordfence advisory
  • CVE-2026-6449. Amelia booking plugin (2.1.2 and earlier): an unauthenticated attacker can approve any booking that is waiting for approval. Medium, CVSS 5.3. Wordfence advisory

Certifications