WordPress
Security Research.
WordPress powers a large share of the web — and with it, an enormous, fast-moving attack surface. GoldNetwork conducts original security research into the WordPress CMS and the plugins and themes that extend it: finding vulnerabilities, understanding how they are exploited, and helping the ecosystem close them.
Research with a public record.
This is not theory. GoldNetwork's founder, Michael Mazzolini, has discovered and responsibly disclosed well over a hundred security vulnerabilities across the WordPress plugin and theme ecosystem — each one verified, coordinated with the vendor, and tracked with a public CVE identifier.
Credited by name for discovering and reporting the critical WooCommerce Payments authentication-bypass vulnerability (CVE-2023-28121) — a flaw affecting millions of online stores, covered by The Hacker News and the wider security press.
they start in the ecosystem around it.
Core WordPress is mature and heavily reviewed. The real risk lives in the tens of thousands of third-party plugins and themes that run with the same privileges as the site itself — code of wildly varying quality, often maintained by small teams, frequently handling authentication, file uploads, payments and personal data.
Our research looks at this ecosystem the way an attacker does: where untrusted input meets dangerous functionality, how access controls fail, and how a single weak plugin can expose an entire site — or an entire fleet of sites built on the same components.
Across the whole
WordPress stack.
Core & architecture
How WordPress handles requests, nonces, capabilities and the options API — and where assumptions break down.
Plugins
The largest attack surface: input handling, AJAX and admin-post endpoints, file operations and update mechanisms.
Themes
Template injection, unsafe shortcodes and option handling in themes that ship far more code than they appear to.
REST API & authentication
Permission callbacks, application passwords, cookie and nonce handling, and the paths that bypass them.
Supply chain
Compromised updates, abandoned plugins and dependency risk across the WordPress.org and premium ecosystems.
Defence & hardening
How request filtering, virtual patching and web-application firewalls detect — and sometimes miss — real attacks.
What we hunt for.
The bugs that matter in WordPress are rarely exotic — they are classic web vulnerabilities in code that runs with high privilege. We study the full range, with a focus on real exploitability and business impact.
From discovery to a fix in users' hands.
Discover
We select targets by reach and risk, then read the code and probe the behaviour.
Analyse
Manual source-code review and dynamic testing to confirm real, exploitable impact.
Prove
A safe proof of concept that demonstrates the issue without putting anyone at risk.
Disclose
Coordinated disclosure to the vendor, with time and detail to ship a proper fix.
Verify
We confirm the patch resolves the issue — and look for variants it may have missed.
We research to defend, not to disrupt.
All of our research follows coordinated, responsible disclosure. When we find a vulnerability we report it privately to the maintainer first, share enough detail to reproduce and fix it, and give a reasonable window for a patch to reach users before any public write-up. Where appropriate, we work with vendors and the relevant authorities to obtain a CVE identifier so the issue is tracked and users can act on it.
We never trade in exploits, and we never test systems we are not authorised to test. The goal of this work is simple: a WordPress ecosystem that is measurably harder to attack, informed by how real attackers actually operate.
If you maintain a widely used WordPress plugin or theme and would like a security review, or you believe you have found an issue in something we work on, we would like to hear from you.
Securing WordPress at scale?
Whether you run one high-value site or thousands, talk to a senior consultant about testing, hardening and research.
Talk to us