Skip to content
EIEnes Ismaili
Research

Public work, held to public standards.

Advisories, plugin audits and tooling that other people can check. When the work is public, the severity has to be defensible. There is no room to inflate a finding.

2
MITRE CAN requests
6
Plugins audited
4
Vulnerable labs
1
Public advisory
01
Advisory

Gerobug v2.7 vulnerability research

I audited the open-source bug bounty platform and confirmed two findings with live proof-of-concept exploits. Two MITRE CVE Numbering Authority reservation requests were filed (CAN-2026-2032157, CAN-2026-2032158) and a security advisory was published on GitHub.

  • 2 confirmed findings
  • 2 CAN requests
  • Public advisory
View on GitHub
02
Research

WordPress plugin security audits

I reviewed widely deployed plugins including WooCommerce, Contact Form 7, WP Meta SEO, Fluent Forms, BackWPup and Post SMTP. The findings went through the Wordfence Bug Bounty program.

  • 6 plugins audited
  • Responsible disclosure
View on GitHub
03
Tooling

Open-source tooling and vulnerable labs

An async rewrite of GCPBucketBrute, a Nuclei template for Swagger/OpenAPI discovery, and four free vulnerable VMs (eNotes, En0wn, WinPriv10, En3t) that people use to practise for certifications. I also wrote a Wazuh FIM guide for WordPress.

  • GCPBucketBrute
  • Nuclei
  • 4 labs
View on GitHub
All repositoriesAdvisory details available on request
Disclosure

Found something? Say so.

This site is a static Next.js deployment with a hardened header policy and no tracking. If you think something here is wrong, I'd rather hear it from you than from a scanner.

enes.ismaili@gmail.com
  • Send a clear description, reproduction steps and the impact you believe it has.
  • Do not access, modify or exfiltrate data that is not yours, and do not disrupt the service.
  • Give me a reasonable window to fix before publishing. 90 days is the default.
  • Good-faith research conducted within these bounds will not be treated as hostile or referred for action.

Machine-readable contact: /.well-known/security.txt

Collaboration

Research that needs a second pair of eyes?

Happy to look at a finding, sanity-check a severity, or help a disclosure land properly with a vendor.

Start a projectEmail directly

Typically replies within one business day. NDA on request.

enes.ismaili@gmail.com