Skip to content
Sign in
5.3 Medium

CVE-2026-86800 The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request…

Description

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.

Affected products and versions

Product Affected versions Fixed in
Hide My WP Ghost 7.0 earliest → < 7.0.11 7.0.11

Other CVEs of Hide My WP Ghost

The 3 CVEs of Hide My WP Ghost →
CVE-2026-86796 The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request… 5.3 Medium CVE-2024-6420 The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect… 8.6 High
Track this CVE