EUVD-2026-49216
GHSA-v2wf-pp9p-h6g4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.
AnalysisAI
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
More in Hide My Wp Ghost
View allThe Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect W
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versio
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticate
The Hide My WP Ghost - Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and
The Hide My WP Ghost - Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all
Open redirect vulnerability in Hide My WP Ghost WordPress plugin versions below 7.0.00 allows unauthenticated remote att
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today