Hide My Wp Ghost
Monthly
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
Open redirect vulnerability in Hide My WP Ghost WordPress plugin versions below 7.0.00 allows unauthenticated remote attackers to redirect users to arbitrary external websites, enabling phishing attacks. The vulnerability requires user interaction (clicking a malicious link) and affects the plugin's URL handling. With an EPSS score of 0.02% and no confirmed active exploitation, this represents a low real-world exploitation risk despite the moderate CVSS score of 4.7.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost allows PHP Local File Inclusion.4.01. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Hide My WP Ghost - Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Hide My WP Ghost - Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
Open redirect vulnerability in Hide My WP Ghost WordPress plugin versions below 7.0.00 allows unauthenticated remote attackers to redirect users to arbitrary external websites, enabling phishing attacks. The vulnerability requires user interaction (clicking a malicious link) and affects the plugin's URL handling. With an EPSS score of 0.02% and no confirmed active exploitation, this represents a low real-world exploitation risk despite the moderate CVSS score of 4.7.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost allows PHP Local File Inclusion.4.01. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Hide My WP Ghost - Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Hide My WP Ghost - Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.