https://hamzatlili.com Advisories and disclosure timelines — coordinated disclosure, on the record. en Tue, 13 Oct 2026 12:00:00 GMT https://hamzatlili.com/writeups/fluentboards-broken-access-control/ https://hamzatlili.com/writeups/fluentboards-broken-access-control/ Thu, 08 Oct 2026 12:00:00 GMT A subscriber-level account could reach board actions that should have been reserved for higher-privileged users. Reported through Patchstack's VDP, patched by WP ManageNinja in FluentBoards 2.2.0, and assigned CVE-2026-109696. Broken Access Control WordPress FluentBoards Access Control https://hamzatlili.com/writeups/woocommerce-order-export-authenticated-sqli/ https://hamzatlili.com/writeups/woocommerce-order-export-authenticated-sqli/ Mon, 05 Oct 2026 12:00:00 GMT Reported with a proof of concept, confirmed by the developer, and patched with esc_sql() — all inside 24 hours. A case study in how fast coordinated disclosure can move. SQL Injection CWE-89 WordPress WooCommerce