WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-601.
Summary
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| johndarrel | Hide My WP Ghost – Security & Firewall | up to 7.0.02 | — | No fix listed | CNA |
- Hide My WP Ghost – Security & Firewall Vendorjohndarrel Affected up to 7.0.02 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-7527
- 2026-10-03 Alias added: GHSA-wc9h-566w-4rw2
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bd88ebd2-5584-4886-9c85-39a225cd00e9?source=cve
- https://plugins.trac.wordpress.org/browser/hide-my-wp/trunk/models/Rewrite.php#L1684
- https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/7.0.01/models/Rewrite.php#L1684
- https://plugins.trac.wordpress.org/browser/hide-my-wp/trunk/models/Rewrite.php#L1679
- https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/7.0.01/models/Rewrite.php#L1679
- https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.5.02/models/Rewrite.php#L1684
- https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.5.02/models/Rewrite.php#L1679
- https://plugins.trac.wordpress.org/changeset/3556343
More johndarrel vulnerabilities
- TI-2024-05959 Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure CVSS 3.1HIGH 8.6
- TI-2025-19780 WordPress Hide My WP Ghost plugin <= 5.4.01 - Local File Inclusion to RCE vulnerability CVSS 3.1CRITICAL 9.8
- TI-2025-01794 WP Ghost <= 5.4.01 - Unauthenticated Limited File Read CVSS 3.1HIGH 7.5
- TI-2022-04143 Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass CVSS 3.1MEDIUM 6.5
- TI-2026-75200 Stored cross-site scripting in Hide My WP Ghost WordPress plugin CVSS 3.1HIGH 7.2
- TI-2023-16868 WordPress Hide My WP Ghost – Security Plugin plugin <= 5.0.25 - Captcha Bypass vulnerability CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-7527 · CVE Program
- CVE-2026-7527 · NVD
- FIRST EPSS
- GHSA-wc9h-566w-4rw2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences