Research by Mor Golan

Technical writeups on vulnerabilities, red team techniques and tooling.

• Windows 11 OOBE: Password Only Sign In Restored Every PC Backup and Saved Credentials Nov 7, 2026

  Windows 11 setup let me skip the Authenticator prompt with only a password, then restore every PC backup and saved credentials with no alert.

• CVE-2026-122675: Cross Site Request Forgery (CSRF) in Wp Social WordPress Plugin Nov 7, 2026

  CVE-2026-122675: a CSRF flaw in the Wp Social WordPress plugin lets an attacker overwrite the site's social login OAuth client IDs and secrets.

• CVE-2026-39732: Unauthenticated SQL Injection in Transliterator WordPress Plugin Oct 30, 2026

  CVE-2026-39732: unauthenticated SQL injection in the Transliterator WordPress plugin (serbian-transliteration) via the name query variable.

• CVE-2026-61989: Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings WordPress Plugin Oct 29, 2026

  CVE-2026-61989: unauthenticated reflected Cross Site Scripting (XSS) in the Easy Property Listings WordPress plugin via a GET array key.

• CVE-2026-115596: Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog WordPress Plugin Oct 28, 2026

  CVE-2026-115596: unauthenticated reflected Cross Site Scripting (XSS) in the eCommerce Product Catalog WordPress plugin through version 3.6.4.

• CVE-2026-112869: Unauthenticated Cross Site Scripting (XSS) in We're Open! WordPress Plugin Oct 24, 2026

  CVE-2026-112869: unauthenticated reflected Cross Site Scripting (XSS) in the We're Open! WordPress plugin (opening-hours) through version 2.6.

• CVE-2026-112222: Broken Access Control in Surfer WordPress Plugin Oct 19, 2026

  CVE-2026-112222: Broken Access Control in the Surfer WordPress plugin lets a Subscriber read the site's Surfer API key from an admin page.

• CVE-2026-95597: Unauthenticated Settings Change in PGALL for WooCommerce (워드프레스 결제 심플페이) WordPress Plugin Oct 9, 2026

  CVE-2026-95597: an unauthenticated settings change in PGALL for WooCommerce lets anyone replace the store's bank transfer account details.

• CVE-2026-94641: Unauthenticated Cross Site Scripting (XSS) in UsersWP WordPress Plugin Oct 9, 2026

  CVE-2026-94641: unauthenticated reflected XSS in the UsersWP WordPress plugin via the bundled wp-super-duper shortcode picker.

• CVE-2026-96838: Cross Site Request Forgery (CSRF) in Blacklist Manager for WooCommerce WordPress Plugin Sep 30, 2026

  CVE-2026-96838: a Cross Site Request Forgery in Blacklist Manager for WooCommerce (<= 2.3.1) that can create a new WordPress administrator.

• CVE-2026-94074: Unauthenticated Broken Access Control in Simply Schedule Appointments WordPress Plugin Sep 30, 2026

  CVE-2026-94074: unauthenticated Broken Access Control in the Simply Schedule Appointments WordPress plugin lets anyone read, edit and delete bookings.