Wordfence Intelligence   >   Vulnerability Researchers   >   Naoki Kawahigashi

Naoki Kawahigashi

Organization: EY Strategy and Consulting Co., Ltd.

313
All Time Ranking
17
All Time Discoveries
0
90 Day Published Submissions
N/A
Last Published Submission

About

Senior Cybersecurity Consultant at EY, focused on penetration testing and red teaming, with particular strength in web application penetration testing. Experience includes 100+ penetration tests, 200+ vulnerability assessments, and 5+ TLPT (Threat-Led Penetration Testing) engagements across the financial, public-sector, and enterprise domains. Holder of CISSP, CCSP, CISA, CISM, CSIE, RISS, and PMP certifications.

17 Vulnerabilities

Nexi XPay Build 7.0.0 - 7.6.2 - Missing Authorization
5.3
CVE-2026-82211
Oct 5, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated Information Exposure
5.3
CVE-2026-103378
Oct 5, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CoCart 4.9.0 - 4.9.6 - Cross-Site Request Forgery to Privilege Escalation
8.8
CVE-2026-93549
Oct 2, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SaveTo Wishlist Lite <= 1.1.4 - Unauthenticated SQL Injection
7.5
CVE-2026-89236
Oct 1, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Payments for Hubtel <= 1.0.1 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2026-96173
Sep 29, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Fusion Lite 3.37.14 - 3.47.14 - Missing Authorization
5.3
CVE-2026-90974
Sep 29, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass
4.3
CVE-2026-88828
Sep 25, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Paid Member Subscriptions <= 3.0.0 - Unauthenticated CAPTCHA Bypass
5.3
CVE-2026-90950
Sep 21, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Really Simple Security (Free) <= 9.8.2 - Unauthenticated Unbounded Option Growth
5.3
CVE-2026-88798
Sep 16, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Login with QR <= 1.0.0 - Authentication Bypass
9.8
CVE-2026-86710
Sep 15, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The Pressengine <= 1.0 - Authentication Bypass
9.8
CVE-2026-86709
Sep 15, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Private Feed Key <= 0.1 - Authentication Bypass
9.8
CVE-2026-86707
Sep 15, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PuppyFW <= 0.4.4 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVE-2026-88904
Sep 15, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
wpShopGermany IT-RECHT KANZLEI <= 2.3 - Unauthenticated Remote Code Execution
9.8
CVE-2026-88795
Sep 15, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Missing Authorization
5.3
CVE-2026-78361
Sep 11, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation
7.3
CVE-2026-78362
Sep 7, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
WPLP Cookie Consent <= 4.4.1 - Missing Authorization
4.3
CVE-2026-85133
Sep 7, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
Nexi XPay Build 7.0.0 - 7.6.2 - Missing Authorization CVE-2026-82211 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N October 5, 2026
Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated Information Exposure CVE-2026-103378 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N October 5, 2026
CoCart 4.9.0 - 4.9.6 - Cross-Site Request Forgery to Privilege Escalation CVE-2026-93549 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H October 2, 2026
SaveTo Wishlist Lite <= 1.1.4 - Unauthenticated SQL Injection CVE-2026-89236 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N October 1, 2026
Payments for Hubtel <= 1.0.1 - Unauthenticated Insecure Direct Object Reference CVE-2026-96173 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N September 29, 2026
Fusion Lite 3.37.14 - 3.47.14 - Missing Authorization CVE-2026-90974 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N September 29, 2026
Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass CVE-2026-88828 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 25, 2026
Paid Member Subscriptions <= 3.0.0 - Unauthenticated CAPTCHA Bypass CVE-2026-90950 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N September 21, 2026
Really Simple Security (Free) <= 9.8.2 - Unauthenticated Unbounded Option Growth CVE-2026-88798 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L September 16, 2026
Login with QR <= 1.0.0 - Authentication Bypass CVE-2026-86710 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H September 15, 2026
The Pressengine <= 1.0 - Authentication Bypass CVE-2026-86709 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H September 15, 2026
Private Feed Key <= 0.1 - Authentication Bypass CVE-2026-86707 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H September 15, 2026
PuppyFW <= 0.4.4 - Authenticated (Subscriber+) Privilege Escalation CVE-2026-88904 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L September 15, 2026
wpShopGermany IT-RECHT KANZLEI <= 2.3 - Unauthenticated Remote Code Execution CVE-2026-88795 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H September 15, 2026
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Missing Authorization CVE-2026-78361 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N September 11, 2026
SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation CVE-2026-78362 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L September 7, 2026
WPLP Cookie Consent <= 4.4.1 - Missing Authorization CVE-2026-85133 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N September 7, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation