Research

Security research, from source to proof

Authored investigations into vulnerabilities whose impact only becomes clear when the full state transition is reproduced. Operational details are scoped to responsible public disclosure.

Published investigations

1 article

WordPress 7.0.1: Following a REST Batch Bug to Remote Code Execution

The first proof had an RCE ending but no defensible middle. Rebuilding that middle exposed how request confusion, object caching, partial updates, and nested dispatch could compose across WordPress core.

July 19, 2026 15 min read Vulnerability research