CVE-2026-86796

17th percentile - higher than 17% of all known CVEs

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections. The mere presence of an attacker-suppliable request parameter is treated as sufficient, allowing unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.

An attacker can disable key site protections and expose login and admin URLs, significantly increasing the risk of unauthorized access. This facilitates brute-force attacks and exploitation of other vulnerabilities.

Update the Hide My WP Ghost plugin to version 7.0.11 or later. Until then, consider deploying WAF rules and monitoring access attempts to concealed URLs.