CVE-2026-59546
HighCVSS 7.4Summary
The Hide My WP Ghost plugin in version 7.0.06 and earlier has a Broken Authentication vulnerability for users with the Subscriber role. These users can bypass authentication mechanisms.
Risk Assessment
Unauthorized subscribers may gain access to administrative functions, compromising the security of the entire site.
Recommendation
Update the Hide My WP Ghost plugin to a version higher than 7.0.06 that fixes this vulnerability.
Other vulnerabilities in Hide My WP Ghost
See all- CVE-2026-81806High
Server-Side Request Forgery (SSRF) vulnerability in Hide My WP Ghost versions up to 7.0.09. Allows an attacker to send requests from the server to internal network resources, potentially leading to disclosure of sensitive information or further attacks.
- CVE-2026-39484Medium
The Hide My WP Ghost plugin for WordPress has an open redirect vulnerability to untrusted sites, enabling phishing attacks. This affects versions below 7.0.00.
Original NVD description (English source)
Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS