WordPress security by component

Hide My WP Ghost

Plugin description

Hide My WP Ghost modifies WordPress identifiers and selected paths to obscure the underlying WordPress installation.

Hide My WP Ghost (hide-my-wp-ghost) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Sep 18, 2026; the highest published CVSS base score is 9.6.

Plugin slug: hide-my-wp-ghost

Latest vulnerability

CVE-2026-86800: Hide My WP Ghost: Invalid loopback checks disable login-location protection

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location. This exposes a concealed login location; it does not establish login bypass or account takeover. The verification field and route are not disclosed. Affected versions reported by the CNA: < 7.0.11. The export identifies 7.0.11 as fixed.

PublishedSep 18, 2026

Known safe version7.0.11

Published vulnerabilities for hide-my-wp-ghost
		Safe version
Sep 18, 2026	CVE-2026-86800 Hide My WP Ghost: Invalid loopback checks disable login-location protection The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location. This exposes a concealed login location; it does not establish login bypass or account takeover. The verification field and route are not disclosed. Affected versions reported by the CNA: < 7.0.11. The export identifies 7.0.11 as fixed.	7.0.11	CVE5.3
Sep 18, 2026	CVE-2026-86796 Hide My WP Ghost: Forged request marker disables plugin protections The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request. The bypass concerns Hide My WP Ghost's own per-request protections; it is not a claim about any hosting security system. The parameter name is not disclosed. Affected versions reported by the CNA: 7.0.10 to < 7.0.11. The export identifies 7.0.11 as fixed.	7.0.11	CVE5.3
Mar 27, 2025	CVE-2025-26909 Hide My WP Ghost: Filesystem traversal Hide My WP Ghost is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE9.6
Feb 12, 2025	CVE-2024-13794 WP Ghost (Hide My WP Ghost) – Security & Firewall: A security weakness WP Ghost (Hide My WP Ghost) – Security & Firewall is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Jul 23, 2024	CVE-2024-6420 Hide My WP Ghost: A security weakness Hide My WP Ghost is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE8.6

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers