Wordfence Intelligence > Vulnerability Researchers > Bao Luu Gia Nguyen

Bao Luu Gia Nguyen

1121

All Time Ranking

All Time Discoveries

90 Day Published Submissions

5 Jun '26

Last Published Submission

About

I'm a security researcher, who has several credited CVEs such as Arbitrary File Write leading to RCE in n8n (CVE-2026-25056), Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access in Flowise (CVE-2026-31829),... I am also a Penetration Tester with a strong focus on offensive security for Web and Mobile platforms. Currently working at FPT Telecom, I specialize in identifying logical flaws and securing business-critical applications.

2 Achievements

Learn more about Achievements

Learn more Learn more about Achievements

2 Vulnerabilities

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings

4.4

CVE-2026-8991

Jun 5, 2026

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API

4.3

CVE-2026-6566

May 19, 2026

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings	CVE-2026-8991	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	June 5, 2026
Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API	CVE-2026-6566	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	May 19, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation