Crucible Active
Vulnerability research against the WordPress plugin ecosystem, disclosed through the channels that assign CVE identifiers.
Crucible is an independent vulnerability research programme aimed at WordPress plugins — finding security defects, confirming they are real, and disclosing them so they get fixed and catalogued.
WordPress runs a large share of the web, and most of the code an ordinary site actually executes is not WordPress. It is plugins: the contact form, the file manager, the membership gate, the checkout extension. That is where the interesting failures are, and it is where this project looks.
How a finding is handled
Everything here is disclosed through a CNA — a body authorised to assign CVE identifiers — which runs the coordination with the vendor. That choice is deliberate. A CNA has an established channel to maintainers, a public catalogue that outlives any one researcher's website, and a disclosure process that does not depend on a stranger being trusted.
The sequence is always the same:
- Confirm before claiming. A defect is reproduced on a clean, current installation before it is written up. If it cannot be reproduced, it is not reported — however good the reasoning looked.
- Claim exactly what was demonstrated. Not the worst case the mechanism suggests, and not less than what was actually shown. Both directions are errors.
- Report, then wait. The CNA coordinates with the vendor. Timing is theirs.
- Publish only after. A finding appears on this site once the CVE is public and the coordinating body confirms disclosure is complete.
That last point is a condition, not a waiting period. There is no number of days that makes an embargoed finding safe to talk about, so there is always a gap — sometimes a long one — between the work and anything written about it here. A quiet page is what the process looks like from outside.
What this project will not do
- No selling. Findings go to the coordinating body and the vendor. Not to a broker, not to a buyer, not to anyone who wants them unfixed.
- No pressure. No self-imposed deadline used as leverage, no "disclose or else". If a vendor is slow, that is between them and the CNA.
- No exploitation. Nothing is tested anywhere but a disposable local installation built for the purpose. No live site, ever, including sites that look abandoned.
- No hinting. An embargoed finding is not teased, not described by mechanism, and not alluded to in a post about something else.
On AI assistance
This research uses AI tooling, and that is disclosed on every submission, because the bodies receiving these reports are entitled to know how they were produced.
It is worth being precise about what that does and does not mean. A model is useful for reading a lot of code carefully and for arguing against a conclusion until it breaks. It is not a source of truth: a plausible, well-written, entirely fictional vulnerability report is exactly the thing these tools produce most easily. So nothing reaches a submission on the strength of an argument alone — every claim is checked against the code, and the impact is demonstrated rather than described.
Advisories
Listed here once the CVE is public and the coordinating body confirms disclosure is complete. Findings that are still in coordination do not appear, in any form.
Each entry names the release the vendor published as carrying the fix. Where a row says so, that release has been read against the vulnerable one — checking that the specific defect is gone, that the new guard refuses rather than merely computing a verdict, and that the diff did not visibly trade one problem for another. That is a reading, not a re-test, and it covers the named defect only.
| CVE | Software | Class | Fixed in | Coordinated by | Active time |
|---|---|---|---|---|---|
| CVE-2026-77826 | RegistrationMagic | Unauthenticated authentication bypass · CVSS 8.8 | 6.0.9.9 | WPScan | not instrumented |
| CVE-2026-82846 | Masteriyo LMS | Stored cross-site scripting · CVSS 6.8 | 3.4.0 | WPScan | 77 min |
| CVE-2026-18056 | HivePress Authentication | Unauthenticated authentication bypass · CVSS 7.5 | 1.1.5 | Wordfence | not instrumented |
About that last column. The 77 minutes is not the time spent writing it up. It is the whole path from opening a plugin we had never looked at to having a finished report in a coordinator's hands. Inside it are the read of the code, the trace from the entry point to the sink, three independent confirmations that the defect is real and reachable, and the report itself. The vendor shipped the fix in the next release. All of it happened on one day.
Active time is wall-clock time inside our research sessions, attributed to that plugin, with any gap over five minutes treated as idle and not counted. It is pipeline time, not human hours. This is an AI-assisted pipeline and every report we file says so. It also leaves out everything that happens outside a session, so filing the form, recording the video and reading the vendor's own source are all missing from it. Read it as a floor, and we round down.
The Masteriyo figure is anchored at the end on our own record of having submitted, rather than on the CNA's ticket number. WPScan does not acknowledge a submission at the moment you make it, so there is no ticket to anchor on until triage some days later. That makes this figure a little weaker than one anchored on the venue's own record, and we would rather say so than quietly present the two as the same thing.
Where our session records do not reach back far enough, we say that instead of showing a number. RegistrationMagic is marked not instrumented because the work on it happened before we kept records that could measure it. That is not a zero, and it is not a gap we can fill in later.
Proof-of-concept detail is withheld by the coordinating body on two of these: until 17 September 2026 for CVE-2026-82846, and until 3 October 2026 for CVE-2026-77826, so that sites have time to update. The Wordfence advisory for CVE-2026-18056 carries no proof-of-concept section at all, so no date attaches to it.
Those dates bind the coordinating body. They do not describe what we do, because we do not publish proofs of concept at all — not for any finding, not at any remove, and not once a date passes. The coordinating bodies carry that detail where they judge it right to. Nothing on this site goes further into mechanism than the advisories themselves.
What that check is not. It covers the one defect named in the row, in the one release named in the row. It is not an audit of the plugin, not a statement about any other version, and not an endorsement of the software or its vendor. A plugin appearing in this table is a plugin that had a defect reported and fixed — which is how it is supposed to work, and says nothing about what else may be in it. If you need assurance about a plugin, this table is not that, and nothing on this site should be read as a reason to skip your own review.
If you maintain a plugin and want to reach us about something, see Disclosure.