EUVD-2026-82685
GHSA-5vw4-phcp-qmr8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network request with trivial complexity (PR:N/AC:L); impact is limited disclosure of concealed URLs and loss of an obscurity layer (C:L), no direct data integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.
AnalysisAI
Unauthenticated attackers can strip the hardening protections from the Hide My WP Ghost WordPress plugin (versions before 7.0.11) by supplying a single WooCommerce-looking request parameter, which the plugin accepts as proof of a legitimate WooCommerce request and uses to switch off its firewall, threat detection and login/URL-hiding logic - re-exposing the concealed login and admin URLs on any request. The issue affects default installations where the plugin's protection features are enabled (its core purpose), requires no authentication, user interaction or non-default configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3), and publicly available exploit code exists, with no confirmed active exploitation reported. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to be running Hide My WP Ghost before version 7.0.11 with its protection features (firewall, threat-detection, login/URL-hiding) enabled - the plugin's core purpose. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuine but moderate-severity issue rather than a critical one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Hide My WP Ghost to 7.0.11 or later - the vendor-released patch for this issue (patch available per vendor; WPScan advisory https://wpscan.com/vulnerability/38baa866-c8a3-4c92-b7c8-8485e7c2a9b0/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hide My Wp Ghost
View allThe Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect W
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
Unauthenticated visitors can strip the login- and URL-hiding protection from WordPress sites running the Hide My WP Ghos
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versio
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticate
The Hide My WP Ghost - Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and
The Hide My WP Ghost - Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all
Open redirect vulnerability in Hide My WP Ghost WordPress plugin versions below 7.0.00 allows unauthenticated remote att
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today