WordPress security by component
Hide My WP Ghost
Plugin description
Hide My WP Ghost changes or conceals recognizable WordPress paths and identifiers displayed by a website.
Hide My WP Ghost (hide-my-wp) is a WordPress plugin with 12 published CVE records in this archive. The latest tracked vulnerability was published Sep 19, 2026; the highest published CVSS base score is 9.8.
Plugin slug:
hide-my-wpLatest vulnerability
CVE-2026-7527: WP Ghost logout links redirect authenticated victims off-site
An unauthenticated attacker persuades a logged-in victim to open a crafted logout URL. The plugin calls wp_logout() before redirecting to an insufficiently validated destination, so the victim is forcibly logged out and sent to a potentially malicious site. The export does not name the destination parameter or establish session theft; the resulting logout cannot be undone by cancelling the later redirect. Authoritative affected range: <= 7.0.02. Confirmed remediation: 7.0.03.
| Safe version |
|
||
|---|---|---|---|
| Sep 19, 2026 |
CVE-2026-7527
WP Ghost logout links redirect authenticated victims off-site
An unauthenticated attacker persuades a logged-in victim to open a crafted logout URL. The plugin calls wp_logout() before redirecting to an insufficiently validated destination, so the victim is forcibly logged out and sent to a potentially malicious site. The export does not name the destination parameter or establish session theft; the resulting logout cannot be undone by cancelling the later redirect. Authoritative affected range: <= 7.0.02. Confirmed remediation: 7.0.03.
|
7.0.03 |
CVE4.7
NVDPending
|
| Sep 08, 2026 |
CVE-2026-81806
Hide My WP Ghost permits unauthenticated server-side request forgery
Hide My WP Ghost through 7.0.09 allows an unauthenticated attacker to influence server-side requests, making the WordPress server issue requests on the attacker's behalf. The CNA rates exploitation as requiring neither privileges nor user interaction, with confidentiality and integrity impact. Version 7.0.10 is identified as unaffected.
|
7.0.10 |
CVE7.2
NVDPending
|
| Jul 27, 2026 |
CVE-2026-59546
Hide My WP Ghost subscribers can bypass two-factor authentication
Hide My WP Ghost through 7.0.06 contains a broken-authentication path that lets a Subscriber bypass two-factor authentication. The Patchstack.
|
7.0.07 |
CVE7.4
NVDPending
|
| Apr 08, 2026 |
CVE-2026-39484
Hide My WP Ghost: An open redirect
Hide My WP Ghost is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination. The published affected range is <= 7.0.00.
|
7.0.00 |
CVE4.7
NVDPending
|
| Jan 22, 2026 |
CVE-2025-69098
Hide My WP: Cross-site scripting
Hide My WP is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVDPending
|
| Mar 14, 2025 |
CVE-2025-2056
WP Ghost (Hide My WP Ghost) – Security & Firewall: Filesystem traversal
WP Ghost (Hide My WP Ghost) – Security & Firewall is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Nov 15, 2024 |
CVE-2024-10825
Hide My WP Ghost – Security & Firewall: Cross-site scripting
Hide My WP Ghost – Security & Firewall is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Jun 04, 2024 |
CVE-2023-34001
Hide My WP Ghost: A security weakness
Hide My WP Ghost is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| May 09, 2023 |
CVE-2022-4537
Hide My WP Ghost – Security Plugin: A security weakness
Hide My WP Ghost – Security Plugin is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD6.5
|
| Feb 06, 2023 |
CVE-2022-4681
Hide My WP: SQL injection
Hide My WP is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Nov 24, 2021 |
CVE-2021-36917
Hide My Wp: A security weakness
Hide My Wp is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD7.5
|
| Nov 24, 2021 |
CVE-2021-36916
SQL injection vulnerability in the Hide My WP: SQL injection
SQL injection vulnerability in the Hide My WP is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.6
NVD9.8
|