CVE-2026-81806
HighCVSS 7.2Summary
Server-Side Request Forgery (SSRF) vulnerability in Hide My WP Ghost versions up to 7.0.09. Allows an attacker to send requests from the server to internal network resources, potentially leading to disclosure of sensitive information or further attacks.
Risk Assessment
An attacker can exploit SSRF to scan the internal network, access internal services, or bypass security controls, potentially leading to data integrity and confidentiality breaches.
Recommendation
Immediately update the Hide My WP Ghost plugin to a version newer than 7.0.09, which contains a fix for this vulnerability.
Other vulnerabilities in Hide My WP Ghost
See all- CVE-2026-59546High
The Hide My WP Ghost plugin in version 7.0.06 and earlier has a Broken Authentication vulnerability for users with the Subscriber role. These users can bypass authentication mechanisms.
- CVE-2026-39484Medium
The Hide My WP Ghost plugin for WordPress has an open redirect vulnerability to untrusted sites, enabling phishing attacks. This affects versions below 7.0.00.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.