Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86800

WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check

CVSS 3.1 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86800

Published

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86800

Published

Hide My WP Ghost

https://wordpress.org/plugins

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Hide My WP Ghost",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "0",
                            "lessThan": "7.0.11"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "collectionURL": "https://wordpress.org/plugins"
                }

Original source record · Cite this exact observation · Complete original publisher JSON