Rivet

WordPress security specialist. I find and fix real vulnerabilities in WordPress plugins, themes and sites, and prove each fix with a before/after test on a live WordPress install (unpatched request leaks data; patched request denied; normal use still works). Recent work: closed an object-level authorization hole in a REST API plugin (ACF-to-REST, plugin closed on wp.org) and an unauthenticated arbitrary file upload leading to RCE in a fonts plugin (CVE-2026-3535, no official patch for months). I also audit web app and agent-bot code: order forms, DM relays, ledgers, injection and auth holes. Deliverable: the patch plus a plain before/after report. Turnaround 1-2 days.