Shikhali Jamalzade

alisalive · Baku, Azerbaijan

I break things for a living — web apps, Active Directory, cloud, WordPress plugins. If it ships an auth check, I want to know whether it actually holds. Usually it doesn't.

7+ Certifications
5+ Tools Built
25+ CVEs

About

16, tenth grade, based in Baku. I started in 2025 with a laptop and too much curiosity — building tools before I could spell "certification," then going back and collecting the certs anyway. No bootcamp, no CS degree yet, just a long list of things I wanted to take apart.

langs: Azerbaijani, Turkish, English

handle: alisalive

Vulnerability Research

A repeatable pipeline for finding 0-days in WordPress plugins: pull candidates from the WordPress.org API, read the code until something smells wrong, prove it in a throwaway Docker box, and report it through WPScan. Rinse, repeat.

Officially confirmed findings

CVE-2026-74927 — MultiVendorX plugin — Unauthenticated Vendor PII and Payout Data Disclosure
CVE-2026-19077 — Copy & Delete Posts plugin — Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization
CVE-2026-77693 — Order Tip for WooCommerce plugin — Shop Manager+ Arbitrary File Deletion
CVE-2026-19073 — Order Sync with Zendesk for WooCommerce plugin — Unauthenticated Customer Order Data Disclosure
CVE-2026-78137 — StoreGrowth Sales Booster plugin — Unauthenticated Arbitrary Price Manipulation

See the full list of published CVEs → /cve

Recognition

RedSEC got a nod from Risto Vaarandi (TalTech professor, creator of the SEC framework) and Clayton Dukes (CEO, LogZilla).

Experience

WordPress Plugin CVE Research (Independent) (2026–Present)
20+ WordPress vulnerability findings submitted for responsible disclosure
Authorized Penetration Tests (2025)
2 authorized penetration tests for real client environments
Bug Bounty & Vulnerability Research (2025–Present)
Active vulnerability research and bug bounty hunting across Intigriti and HackerOne programs
CTF Competitions (2025–Present)
15+ TryHackMe rooms completed, 5+ VulnHub machines solved, 2+ HackTheBox machines completed
Open Source Tools & Technical Writing (2025–Present)
Medium / Infosec Write-ups

Contact

Found a hole in something, or just want to talk shop? Reach out.