(Dan Tri Newspaper) – Nguyen Chi Khanh has discovered four security vulnerabilities in WordPress widgets. One vulnerability is rated as critical and can be exploited even without the attacker logging in.
This is a remarkable achievement by Nguyen Chi Khanh (born in 2004, from Ca Mau), a fourth-year student majoring in Information Security atFPT University, Can Tho campus.
While reviewing thethat directly inserted data into a database query without the necessary security processing. Suspecting this might be a security vulnerability, the student set up his own testing environment to verify it
As a result, Khanh discovered one SQL Injection vulnerability. Continuing to examine theties of the same type
WordPress is a popular platform that allows individuals and businesses to build and manage websites without having to write all the programming code themselves. This platform has many extensions, called plugins, to add functionality such as scheduling, forums, or content management.
The findings were reported through Patchstack’s security vulnerability program, an organization specializing in security research for the WordPress ecosystem. After verification, the three vulnerabilities were assigned international CVE identifiers, allowing the security community to search and reference them consistently.
Three vulnerabilities have been identified in two WordPress extensions: WP w3all phpBB and WP BASE Booking. The vulnerability in WP w3all phpBB was disclosed on August 20th; the two vulnerabilities in WP BASE Booking were disclosed on October 5th.
According to the assessment provided by Khanh, the CVE-2026-103352 vulnerability in WP BASE Booking scored 9.3/10 and did not require the attacker to log in. This score, according to the security vulnerability severity rating system, falls into the critical category.
The remaining two vulnerabilities scored 8.5 points and could be exploited if the perpetrator had a Subscriber-level account – a low-privilege account level on WordPress, typically only allowing login and personal information management. Therefore, the risk could still exist on websites that allow users to register accounts themselves.
The fourth vulnerability was just confirmed on October 13th.
Khanh began researching WordPress features around July of this year. He proactively chose this path because WordPress is a popular website building platform with many extensions developed by individuals and organizations. Most of themost confident in
All three errors Khanh discovered were of the type where the query results were not displayed directly on the website. Therefore, the student had to check for indirect signs to prove the error actually existed, instead of just looking at the website screen.
Each vulnerability takes Khanh about 1-2 days to investigate, from the initial detection of anomalies to the verification of exploitability. The most time-consuming part is developing clear steps to replicate the vulnerability so that the receiving organization can independently verify it.
For the male student, this is a significant milestone in his studies and research, and it also provides further motivation to continue pursuing the field of <a href="https://bitcomme.com/gillette-cybersecurity-duo-on-mission-to-stop-cyber-hackers-from-destroying-lives/” title=”Gillette Cybersecurity Duo On Mission To Stop Cyber-Hackers From Destroying Lives”>cybersecurity.
CVEs are a widely used identification system for naming and searching for publicly disclosed security vulnerabilities. Simply put, each CVE is like a unique reference code, helping developers, security experts, and software users to accurately identify the issue in question.
Fourth-year students are already working in the cybersecurity field.
Besides the three vulnerabilities identified by CVE code, the male student also achieved top 2 in the F-Hacker competition in 2023 and 2024, and received the Outstanding Student award in multiple semesters at the university.
Although he hadn’t graduated from university yet, Khanh had about a year of experience working as a penetration tester for a company, earning a comfortable income to cover his studies and living expenses. This job involves proactively testing systems within a permitted scope, simulating how attackers might find and exploit vulnerabilities to help management identify and mitigate risks.
Khanh stated that she wants to continue pursuing a career in penetration testing and security research. She plans to maintain her work in finding and reporting vulnerabilities through specialized programs alongside her studies and work experience.
Highly appreciating the vulnerabilities discovered by Nguyen Chi Khanh, Mr. Nguyen Minh Triet, a lecturer in Information Security at FPT University, Can Tho campus, commented that the student excelled in practical skills, curiosity, and a spirit of exploring security weaknesses.
According to the instructor, if only considering class grades, Khanh is not the most outstanding student. However, she has good practical skills and the ability to perform tasks that not all students can do.
Mr. Triet believes that exposure to a real-world environment, especially during the internship period, helped Khanh develop in the professional field she loves.
Original article
https://dantri.com.vn/giao-duc/sinh-vien-phat-hien-4-lo-hong-bao-mat-duoc-cap-ma-quoc-te-20261013214454726.htm
Tag:studentSecurity vulnerabilityNguyen Chi KhanhWordPress security vulnerabilitiesSecurity
