CVE-2026-39484
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Hide My WP Ghost plugin for WordPress has an open redirect vulnerability to untrusted sites, enabling phishing attacks. This affects versions below 7.0.00.
Risk Assessment
An attacker can redirect users to malicious sites, potentially leading to credential theft or malware installation.
Recommendation
Immediately update the Hide My WP Ghost plugin to version 7.0.00 or later.
Other vulnerabilities in Hide My WP Ghost
See all- CVE-2026-59546High
The Hide My WP Ghost plugin in version 7.0.06 and earlier has a Broken Authentication vulnerability for users with the Subscriber role. These users can bypass authentication mechanisms.
- CVE-2026-81806High
Server-Side Request Forgery (SSRF) vulnerability in Hide My WP Ghost versions up to 7.0.09. Allows an attacker to send requests from the server to internal network resources, potentially leading to disclosure of sensitive information or further attacks.
Original NVD description (English source)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS