Hide My Wp Ghost
Monthly
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
Unauthenticated visitors can strip the login- and URL-hiding protection from WordPress sites running the Hide My WP Ghost plugin before 7.0.11 by triggering the plugin's own loopback security-check request with a missing or incorrect verification value, causing the concealment to fail open and re-exposing the hidden WordPress login page location. The flaw is network-reachable, low complexity, and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3), but its impact is deliberately narrow: it only reverts the site to its ordinary, unhidden login posture and does not bypass WordPress authentication, so real-world risk depends on the strength of the underlying credentials and any additional login protections in place. Publicly available exploit code exists and the issue is tracked by WPScan as well as ENISA EUVD-2026-82686; a vendor fix is available in version 7.0.11, and there is no indication of confirmed active exploitation (no CISA KEV listing) and no EPSS score was provided in the source data.
Unauthenticated attackers can strip the hardening protections from the Hide My WP Ghost WordPress plugin (versions before 7.0.11) by supplying a single WooCommerce-looking request parameter, which the plugin accepts as proof of a legitimate WooCommerce request and uses to switch off its firewall, threat detection and login/URL-hiding logic - re-exposing the concealed login and admin URLs on any request. The issue affects default installations where the plugin's protection features are enabled (its core purpose), requires no authentication, user interaction or non-default configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3), and publicly available exploit code exists, with no confirmed active exploitation reported. The impact is indirect - WordPress core authentication is not bypassed - but any site treating this plugin as a meaningful obscurity control effectively loses that protection until it is upgraded to 7.0.11 or later.
Open redirect vulnerability in Hide My WP Ghost WordPress plugin versions below 7.0.00 allows unauthenticated remote attackers to redirect users to arbitrary external websites, enabling phishing attacks. The vulnerability requires user interaction (clicking a malicious link) and affects the plugin's URL handling. With an EPSS score of 0.02% and no confirmed active exploitation, this represents a low real-world exploitation risk despite the moderate CVSS score of 4.7.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost allows PHP Local File Inclusion.4.01. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Hide My WP Ghost - Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Hide My WP Ghost - Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
Unauthenticated visitors can strip the login- and URL-hiding protection from WordPress sites running the Hide My WP Ghost plugin before 7.0.11 by triggering the plugin's own loopback security-check request with a missing or incorrect verification value, causing the concealment to fail open and re-exposing the hidden WordPress login page location. The flaw is network-reachable, low complexity, and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3), but its impact is deliberately narrow: it only reverts the site to its ordinary, unhidden login posture and does not bypass WordPress authentication, so real-world risk depends on the strength of the underlying credentials and any additional login protections in place. Publicly available exploit code exists and the issue is tracked by WPScan as well as ENISA EUVD-2026-82686; a vendor fix is available in version 7.0.11, and there is no indication of confirmed active exploitation (no CISA KEV listing) and no EPSS score was provided in the source data.
Unauthenticated attackers can strip the hardening protections from the Hide My WP Ghost WordPress plugin (versions before 7.0.11) by supplying a single WooCommerce-looking request parameter, which the plugin accepts as proof of a legitimate WooCommerce request and uses to switch off its firewall, threat detection and login/URL-hiding logic - re-exposing the concealed login and admin URLs on any request. The issue affects default installations where the plugin's protection features are enabled (its core purpose), requires no authentication, user interaction or non-default configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3), and publicly available exploit code exists, with no confirmed active exploitation reported. The impact is indirect - WordPress core authentication is not bypassed - but any site treating this plugin as a meaningful obscurity control effectively loses that protection until it is upgraded to 7.0.11 or later.
Open redirect vulnerability in Hide My WP Ghost WordPress plugin versions below 7.0.00 allows unauthenticated remote attackers to redirect users to arbitrary external websites, enabling phishing attacks. The vulnerability requires user interaction (clicking a malicious link) and affects the plugin's URL handling. With an EPSS score of 0.02% and no confirmed active exploitation, this represents a low real-world exploitation risk despite the moderate CVSS score of 4.7.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost allows PHP Local File Inclusion.4.01. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Hide My WP Ghost - Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Hide My WP Ghost - Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.