Hide My WP Ghost

Vulnerabilities

• CVE-2025-26909

  WordPress Hide My WP Ghost plugin <= 5.4.01 - Local File Inclusion to RCE vulnerability

  Critical 9.8

• CVE-2021-36916

  WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability

  Critical 9.8

• CVE-2025-2056

  WP Ghost <= 5.4.01 - Unauthenticated Limited File Read

  High 7.5

• CVE-2021-36917

  WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability

  High 7.5

• CVE-2026-59546

  WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability

  High 7.4

• CVE-2026-81806

  WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability

  High 7.2

• CVE-2022-4537

  Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass

  Medium 6.5

• CVE-2024-10825

  Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL

  Medium 6.1

• CVE-2024-13794

  Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure

  Medium 5.3

• CVE-2023-34001

  WordPress Hide My WP Ghost – Security Plugin plugin <= 5.0.25 - Captcha Bypass vulnerability

  Medium 5.3

• CVE-2026-7527

  WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter

  Medium 4.7

• CVE-2026-39484

  WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerability

  Medium 4.7