Naiche / WordPress developer / Netherlands
I’m Naiche, a junior developer building custom WordPress themes and plugins, and apps with Laravel. I also review other people’s WordPress code for security issues and report what I find privately to its developer first.
01 / Published advisories
Reported privately first, then published.
Proof-of-concept details stay withheld until a fix ships.
Showing all advisories.
The plugin does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.
The plugin does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.
Both reports were triaged and verified by the WPScan team. Thanks for the time and care they put into that.
WordPress plugins
EU and Dutch compliance for invoicing, checkout, returns, and privacy.
27 modules across ten areas. Every module is off by default.
Hardening, 2FA, brute-force protection, IP banning, and backups.
41 modules replace 22 named plugins. Every feature is a toggle, off by default.
Form builder with 17 field types. Entries and uploads are encrypted with libsodium.
Blocks tracking scripts until consent, without a consent database.
Dark mode for WordPress admin, with no settings page. I took it over from a previous owner.
Syncs a Mobilox/Hexon car-dealer inventory feed into a configurable WordPress post type.
When I find something in someone else’s code, I report it privately and give them time to fix it. I ask for the same in return. A site that argues for responsible disclosure should be reachable by it.
01Start on my public WordPress.org profile and ask for a private route before sharing details. Include the version, the request and enough to reproduce the issue.
02Expect a human reply, not a ticket number. I read every report.
03Details stay private until a fix ships. If you want credit when it does, say so and you will get it.
04If a fix cannot repair damage already done, the changelog will say that plainly.
Contact: https://profiles.wordpress.org/naiches/
Expires: 2027-09-01T00:00:00.000Z
Preferred-Languages: en, nl
Canonical: https://naiche.nl/.well-known/security.txt
Policy: https://naiche.nl/#nsc-report
One report, one afternoon · wordpress.org support
naiches“Found the issue! Just released a fix for this! Let me know if it works.”
reporter“That was quick 🙂 Yes, just tested again there and it’s all working now. Thanks!”
Vulnerability testing of a WordPress site or plugin is available on request. Nothing is touched before scope is agreed in writing, and the sequence below is not negotiable — it is what separates a test from an attack.
No testing begins without a signed scope naming the systems, the window and the limits. Verbal agreement is not approval.
A short conversation first: what the site does, what worries you, and whether a test is the right instrument at all. Sometimes the honest answer is that it is not.
Proof that the systems in scope are yours to authorise — control of the domain, the hosting account, or a written mandate from whoever holds them.
A signed scope: the exact hosts and endpoints, the test window, the techniques excluded, the data that must not be touched, and who to reach if something breaks.
Findings arrive as symptom, cause and blast radius — with what a fix repairs and what it cannot.
NOTesting of systems you do not own or cannot authorise, whatever the reason given.
NODenial-of-service, load testing or anything that trades availability for a finding.
NOThird-party data taken off the system; evidence stays minimal and is destroyed after the report.
NOPublication of anything found, at any point, without your explicit agreement.
For WordPress, Laravel or security work, start on my public WordPress.org profile. It is not a private inbox; ask there for a private route without posting sensitive details.