EUVD-2026-51004
GHSA-49jm-q6q7-76gc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Description states unauthenticated exploitation (PR:N overrides provided PR:L); impact limited to integrity via security control bypass; no confidentiality or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.
AnalysisAI
IP spoofing via untrusted HTTP headers in WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 allows unauthenticated attackers to defeat the plugin's own brute-force login protection and downgrade its firewall by forging headers that match a hardcoded whitelisted IP range. The plugin fails to validate that IP-sourcing headers (such as X-Forwarded-For or X-Real-IP) originate from a trusted reverse proxy, making any client-controlled header a viable forgery vector. A publicly available proof-of-concept exists per WPScan's disclosure, though EPSS remains low (0.16%, 5th percentile) and no active exploitation has been confirmed in CISA KEV.
Technical ContextAI
The affected component is the WP Ghost (Hide My WP Ghost) plugin for WordPress, covering all versions up to but not including 7.0.05 (CPE: cpe:2.3:a:unknown:wp_ghost_(hide_my_wp_ghost):*:*:*:*:*:*:*:*). The root cause is CWE-290 (Authentication Bypass by Spoofing): the plugin reads client IP from HTTP headers such as X-Forwarded-For, X-Real-IP, or CF-Connecting-IP without first confirming the request traversed a trusted reverse proxy. This is a well-understood class of error in proxy-aware web applications - when a server behind a load balancer trusts these headers unconditionally, any remote client can forge them. The compounding factor here is a hardcoded whitelisted IP range within the plugin's firewall logic; an attacker who crafts a header value matching that range is automatically granted elevated trust, bypassing both the brute-force throttling mechanism and the plugin-level firewall rules entirely.
RemediationAI
The primary fix is to upgrade the WP Ghost (Hide My WP Ghost) plugin to version 7.0.05 or later via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository. Version 7.0.05 is the vendor-confirmed patched release per WPScan's disclosure at https://wpscan.com/vulnerability/d3bf6487-88a9-4fc7-87b6-5e739519aa64/. As a compensating control prior to patching, administrators should restrict access to the WordPress login endpoint (wp-login.php and xmlrpc.php) at the web server or WAF level using IP allowlisting to trusted source IPs, which removes the attacker's ability to reach the vulnerable brute-force protection layer regardless of header forgery. If the site operates behind a reverse proxy or CDN, configure that infrastructure to strip and re-inject IP headers authoritatively so the application layer cannot receive client-forged values - this is a defence-in-depth measure with no user-facing trade-offs. Note that disabling the plugin entirely as a workaround removes all WP Ghost security obfuscation protections, which may be an unacceptable trade-off for sites relying on it.
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today