WP Ghost CVE-2026-7527

Exploitation requires social engineering: the attacker must trick a currently logged-in WordPress user into clicking a specially crafted logout URL whose redirect destination is not validated by the plugin (Rewrite.php logout-redirect handling, all versions <=7.0.02). This is the limiting factor - it is not a hands-off remote attack despite PR:N, because UI:R mandates victim interaction. Any WP site with Hide My WP Ghost/WP Ghost <=7.0.02 installed is affected in default configuration; there is no special feature toggle needed. The attack also depends on the victim being authenticated at click time, since the flaw rides the logout flow.

This is a genuinely low-to-moderate real-world risk, and the vendor CVSS of 4.7 is appropriate. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) tells a consistent story: network-reachable and unauthenticated to launch, but gated by required user interaction (UI:R) - the attacker must social-engineer a logged-in victim into clicking a crafted logout URL. Impact is confidentiality-none, integrity-low, availability-none: the only technical effect is redirecting the browser to an attacker-chosen site (classic CWE-601), with the notable side effect that the victim is first logged out via wp_logout(), so the redirect is issued from an unauthenticated state. No EPSS score, no CISA KEV listing, and no public exploit are present in the supplied intelligence - so exploitation status is 'no public exploit identified at time of analysis.' Open redirects are primarily useful as a phishing/credential-harvesting stepping stone (lending legitimacy to a malicious link via a trusted domain) rather than a direct compromise, which keeps real priority low. There is a mild internal tension worth noting: S:C (scope changed) is a defensible-but-generous choice for an open redirect - the impact stays within the victim's browser session, and reasonable analysts assign S:U here - but it only nudges the score marginally. Bottom line: patch in routine cycles, not as an emergency.

An attacker crafts a logout URL for a target WordPress site running Hide My WP Ghost, embedding an attacker-controlled destination in the unvalidated redirect parameter, then delivers it via phishing email or a malicious link to a logged-in user. When the victim clicks, the plugin calls wp_logout() and then redirects the now-unauthenticated browser to the attacker's site - ideal for a convincing fake login page to harvest re-entered credentials. No public exploit code is identified in the available intelligence, and success depends on the victim clicking (UI:R).