Kevin Mosbahi Kevin Mosbahi Also known as Mika

Cybersecurity Researcher

Kevin Mosbahi

Security Researcher · Ethical Hacker · CVE Researcher

Also known as Mika.

I discover, analyse and responsibly disclose security vulnerabilities in WordPress plugins — through manual, white-box source-code auditing. My work is credited across major vulnerability databases and security platforms.

#7 Worldwide #1 France 700+ CVEs 2000+ Days on TryHackMe

Explore the research View profile · Wordfence
Illustrated avatar of Kevin Mosbahi (Mika), cybersecurity researcher
#7 Wordfence
All-Time

Achievements

#7 Worldwide Wordfence all-time researcher ranking #1 France The French researcher with the most CVEs 700 CVEs Unique CVEs credited on Wordfence (712 all-time discoveries) 2000+ Days Consecutive learning streak on TryHackMe

Selected CVE research

Representative WordPress vulnerabilities, responsibly disclosed and credited by major security platforms.

Explore the research →
CriticalCVSS 9.8CVE-2024-52416

Unauthenticated Remote Code Execution

Plugin
Debug Tool
Affected
≤ 2.2
Class
Remote Code Execution
CWE
CWE-94
Disclosed
2024-11-16
CriticalCVSS 9.8CVE-2024-50492

Unauthenticated Remote Code Execution

Plugin
ScottCart
Affected
≤ 1.1
Class
Remote Code Execution
CWE
CWE-94
Disclosed
2024-10-25
CriticalCVSS 9.8CVE-2024-56066

Unauthenticated Privilege Escalation

Plugin
Agency Toolkit
Affected
≤ 1.0.23
Class
Privilege Escalation
CWE
CWE-862
Disclosed
2024-12-31
CriticalCVSS 9.8CVE-2024-56205

Unauthenticated Privilege Escalation

Plugin
AI Magic
Affected
≤ 1.0.4
Class
Privilege Escalation
CWE
CWE-862
Disclosed
2024-12-18
CriticalCVSS 9.8CVE-2025-31612

Unauthenticated PHP Object Injection

Plugin
CBX Poll
Affected
≤ 1.2.7
Class
PHP Object Injection
CWE
CWE-502
Disclosed
2025-03-31
CriticalCVSS 9.8CVE-2024-54367

Unauthenticated PHP Object Injection

Plugin
ForumWP
Affected
≤ 2.1.0
Class
PHP Object Injection
CWE
CWE-502
Disclosed
2024-12-11
CriticalCVSS 9.8CVE-2023-32590

Unauthenticated SQL Injection

Plugin
Subscribe to Category
Affected
≤ 2.7.4
Class
SQL Injection
CWE
CWE-89
Disclosed
2023-07-20
CriticalCVSS 9.8CVE-2024-52447

Unauthenticated Arbitrary File Deletion

Plugin
Contact Page With Google Map
Affected
≤ 1.6.1
Class
Broken Access Control
CWE
CWE-862
Disclosed
2024-11-18
CriticalCVSS 9.6CVE-2025-23532

CSRF to Privilege Escalation

Plugin
MyAnime Widget
Affected
≤ 1.0
Class
Cross-Site Request Forgery
CWE
CWE-352
Disclosed
2025-01-16

WordPress security

Manual, white-box WordPress plugin auditing

Source-code review of WordPress plugins to uncover broken access control, privilege escalation, authentication flaws and remote code execution — followed by coordinated, responsible disclosure.

Read more →
  • PHP Object Injection
  • SQL Injection
  • Remote Code Execution
  • Privilege Escalation
  • Broken Access Control
  • Cross-Site Scripting
  • Cross-Site Request Forgery
  • Sensitive Data Exposure
2000+ day learning streak

TryHackMe

2000+ consecutive days of learning

A continuous daily practice on TryHackMe — from student to working in cybersecurity — featured in TryHackMe's official blog.

Read more → TryHackMe feature ↗

Recognition & publications

Interview Interview with Kevin Mosbahi aka Mika Patchstack ↗ Feature 2000 Days of Learning: From Student to Cybersecurity Engineer TryHackMe ↗

Research profiles