WordPress security changelog
MEDIUM CVE-2026-7527 Deferred

WP Ghost logout links redirect authenticated victims off-site

An unauthenticated attacker persuades a logged-in victim to open a crafted logout URL. The plugin calls wp_logout() before redirecting to an insufficiently validated destination, so the victim is forcibly logged out and sent to a potentially malicious site. The export does not name the destination parameter or establish session theft; the resulting logout cannot be undone by cancelling the later redirect. Authoritative affected range: <= 7.0.02. Confirmed remediation: 7.0.03.

CVE / CNA score 4.7 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Hide My WP Ghost – Security & Firewall
Plugin slug
hide-my-wp
Affected
<= 7.0.02
Safe version
7.0.03
Published
Sep 19, 2026
Weakness
CWE-601 — URL Redirection to Untrusted Site ('Open Redirect')

This CVE was published Sep 19, 2026 and is one of 12 known issues for this plugin.

What to do

Update, patch or deactivate.

Confirmed fixed release: 7.0.03. The release fixes the unauthenticated redirect_to open redirect on the custom logout URL. Official changelog: https://wordpress.org/plugins/hide-my-wp/#developers . Constrain redirect destinations to trusted local locations and validate request integrity for logout. Avoid untrusted logout links and restrict the affected redirect flow until updated.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

References

Primary and upstream sources