oolongeya@gmail.com
DreamHackRed teaming and penetration testing in WEB/APP environments.
oolongeya
Offensive Security Engineer
Performed red teaming and penetration testing at a financial company in South Korea. Began participating in CTF competitions in 2022 and bug bounty programs in 2026.
•Experience
I have gained expertise in establishing and evaluating end-to-end information security processes within given environments.
•Vulnerability Reports
- *
- *
- The plugin does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
- A low-privileged user can submit arbitrary post IDs through Content AI bulk actions and trigger unauthorized processing of protected content.
- Insufficient authorization checks in the term path can allow unauthorized post title modification under ID-collision conditions.
- A low-privileged user can pass permission checks with their own object ID and overwrite metadata rows of other users by targeting foreign meta IDs.
- A low-privileged contributor can inject attacker-controlled URLs into Kubio block attributes to trigger server-side fetches and save responses into public uploads. This enables SSRF-like access to internal resources and unauthorized data exposure despite normal media upload restrictions.
- By taking over admin privileges, restricted features can be controlled.
- By taking over admin privileges, restricted features can be controlled.
•Bug Bounty
Total 💵 : ₩ 13,572,000
- bypassing authorization checks on an internal write endpoint.
- Unauthenticated access and large-scale data exposure are possible through API abuse.
- A malicious phishing link under a PayPal domain can be generated and redirect users to a malicious site when clicked.
- The plugin does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
- CSRF is possible via a nonce-bypass request.
- A low-privileged user can queue unauthorized bulk processing on protected posts through Content AI bulk actions.
- Authorization weakness in updateMetaBulk can lead to unauthorized post title updates in specific ID-collision scenarios.
- An object-level authorization mismatch in updateSchemas allows unauthorized overwrite of foreign post metadata.