Hide My WP Ghost: Forged request marker disables plugin protections
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request. The bypass concerns Hide My WP Ghost's own per-request protections; it is not a claim about any hosting security system. The parameter name is not disclosed. Affected versions reported by the CNA: 7.0.10 to < 7.0.11. The export identifies 7.0.11 as fixed.
- Component
- Hide My WP Ghost
- Plugin slug
hide-my-wp-ghost- Affected
- 7.0.10 to < 7.0.11
- Safe version
7.0.11- Published
- Sep 18, 2026
This CVE was published Sep 18, 2026 and is one of 5 known issues for this plugin.
Update, patch or deactivate.
The authoritative export identifies 7.0.11 as fixed. Update to that release or a later supported version. Validate the genuine WooCommerce request context before taking any exception path, rather than trusting a client-supplied marker. Keep protective checks enabled on unverified requests.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N