WordPress Security Audit
A full authorised vulnerability assessment of a live WordPress site — identified critical third-party plugin flaws and verified the fixes afterwards.
An authorised vulnerability assessment of a production WordPress site. The goal was to find the real risks — mostly hiding in third-party components — and then see the site hardened, with permission throughout.
The work#
I mapped the attack surface using Kali Linux and WPScan-style enumeration to find outdated core and plugin versions, then analysed and verified the known CVEs against them — including a potential remote code execution and an admin-context authentication bypass. The output was a detailed report with risk ratings and concrete remediation steps for the site owner. After patching, I ran a re-audit to confirm the fixes held and the site was in a genuinely better state than when I started.
Next, have a look at
Web Security Audit — febel.ch
An authorised white-hat audit of febel.ch's comment and form endpoints — found a reCAPTCHA v3 bypass and a DoS vector, then helped harden them.
ClipVault
Native clipboard manager for Linux, built in Rust and Tauri — captures text, links, colours and images locally and stays out of the way at ~10–20 MB idle.