CVE-2026-86800

MediumCVSS 5.3

Published: 18/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection. The protection is dropped when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.

Risk Assessment

An attacker can reveal the real login page address, facilitating brute-force attacks and vulnerability targeting. This weakens the plugin's core protective function.

Recommendation

Update the Hide My WP Ghost plugin to version 7.0.11 or later. Until then, consider additional login protections such as IP restrictions and strong passwords.

Other vulnerabilities in Hide My WP Ghost WordPress plugin

CVE-2026-86796Medium
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections. The mere presence of an attacker-suppliable request parameter is treated as sufficient, allowing unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.

Original NVD description (English source)

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS