01
Only with a policy
I only test systems of organisations that publish a coordinated vulnerability disclosure policy, and I report directly to them.
Independent security researcher · NL
Unknown. Reported. Patched. Well-known.
I'm Aaron. I look for vulnerabilities in WordPress plugins and in systems of organisations that publish a disclosure policy. I report privately, wait for the fix, and only then make it public.
// disclosures
Public findings.
Every vulnerability listed here was reported privately first and published only after a fix or the agreed deadline.
Found
Reported
Fixed
Published
-
CVE-2026-118637 Medium
Contributor+ disclosure of private and draft downloads · Simple Download Monitor
A shortcode in Simple Download Monitor rendered download items without checking their status. Any user with the Contributor role could show the titles and descriptions of private, draft and other non-public downloads by placing the shortcode in a post and previewing it.
-
CVE-2026-118523 Medium
Unauthenticated disclosure of pending posts via a post status override · EventPrime
EventPrime let a request choose which post statuses to query. A visitor without an account could override the public status filter and read pending posts that were still waiting for review and had not been published yet.
$ ls ./published
Nothing public yet. Reports are in progress and appear here once they are fixed and coordinated.
// approach
How I work.
Clear rules, the same every time. If you received a report from me, this is what you can expect.
02
Stay in scope
I stick to the published scope and go no further than needed to show a vulnerability exists.
03
Prove, don't take
I don't view, copy, change or delete data. Showing that it is possible is enough.
04
No noisy attacks
No denial of service, social engineering, phishing or brute force, and no third-party systems, even on shared infrastructure.
05
Traceable traffic
All testing comes from a Dutch IP address, without VPN or anonymisation services.
06
Coordinate first
Nothing is published without coordination. Unless your policy says otherwise I allow 90 days, and I'm happy to talk if you need more time.
07
Plugins, locally
WordPress plugin research happens only on my own local installations, and is reported through Wordfence or Patchstack.
08
Not a sales pitch
I don't sell security services. A report from me is never the start of a sales conversation.
// contact
Got a report from me? Or a question?
Write in Dutch or English. Encrypt with my PGP key if the content is sensitive.
PGP fingerprint
B020 0E62 803D 0738 D9B1
8003 2F3C 19D2 EC5B 7330