Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-7527

WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter

CVSS 3.1 4.7 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-7527

Published

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-7527

Published

Hide My WP Ghost – Security & Firewall

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "johndarrel",
                    "product": "Hide My WP Ghost – Security & Firewall",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "7.0.02",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON