CVE-2026-59546

HighCVSS 7.4

Published: 27/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Summary

The Hide My WP Ghost plugin in version 7.0.06 and earlier has a Broken Authentication vulnerability for users with the Subscriber role. These users can bypass authentication mechanisms.

Risk Assessment

Unauthorized subscribers may gain access to administrative functions, compromising the security of the entire site.

Recommendation

Update the Hide My WP Ghost plugin to a version higher than 7.0.06 that fixes this vulnerability.

Other vulnerabilities in Hide My WP Ghost

CVE-2026-39484Medium
The Hide My WP Ghost plugin for WordPress has an open redirect vulnerability to untrusted sites, enabling phishing attacks. This affects versions below 7.0.00.

Original NVD description (English source)

Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.