Wp Ghost Hide My Wp Ghost
Monthly
IP spoofing via untrusted HTTP headers in WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 allows unauthenticated attackers to defeat the plugin's own brute-force login protection and downgrade its firewall by forging headers that match a hardcoded whitelisted IP range. The plugin fails to validate that IP-sourcing headers (such as X-Forwarded-For or X-Real-IP) originate from a trusted reverse proxy, making any client-controlled header a viable forgery vector. A publicly available proof-of-concept exists per WPScan's disclosure, though EPSS remains low (0.16%, 5th percentile) and no active exploitation has been confirmed in CISA KEV.
IP spoofing via untrusted HTTP headers in WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 allows unauthenticated attackers to defeat the plugin's own brute-force login protection and downgrade its firewall by forging headers that match a hardcoded whitelisted IP range. The plugin fails to validate that IP-sourcing headers (such as X-Forwarded-For or X-Real-IP) originate from a trusted reverse proxy, making any client-controlled header a viable forgery vector. A publicly available proof-of-concept exists per WPScan's disclosure, though EPSS remains low (0.16%, 5th percentile) and no active exploitation has been confirmed in CISA KEV.