EUVD-2026-72652
GHSA-6v4m-2c3x-c677
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Network-reachable unauthenticated SSRF with scope change to internal systems; limited C:L/I:L impact aligns with SSRF reach without direct code execution.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery.
This issue affects Hide My WP Ghost: from n/a through 7.0.09.
Articles & Coverage 2
AnalysisAI
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required per the CVSS PR:N designation, and network access alone (AV:N/AC:L) is sufficient - no special configuration of the plugin beyond its presence and activation on a WordPress site is stated in the available data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.2 score is driven by AV:N/AC:L/PR:N/UI:N - unauthenticated, low-complexity, network-reachable exploitation requiring no user interaction - combined with a scope change that amplifies potential blast radius beyond the WordPress host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Operators should update Hide My WP Ghost to the first release above 7.0.09 once available via the WordPress plugin repository or the vendor's own channel; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/hide-my-wp/vulnerability/wordpress-hide-my-wp-ghost-plugin-7-0-09-server-side-request-forgery-ssrf-vulnerability should be monitored for the confirmed patched version, which has not been independently verified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances using Hide My WP Ghost version 7.0.09 or earlier and assess whether they have access to cloud infrastructure or sensitive internal networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hide My Wp Ghost
View allThe Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect W
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versio
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain
The Hide My WP Ghost - Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and
The Hide My WP Ghost - Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all
Open redirect vulnerability in Hide My WP Ghost WordPress plugin versions below 7.0.00 allows unauthenticated remote att
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today