CVE-2026-11870
Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass
CVSS Score
5.4
EPSS Score
0.2%
EPSS Percentile
5th
The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.
| Vendor | unknown |
| Product | wp ghost (hide my wp ghost) |
| Published | Jul 30, 2026 |
| Last Updated | Jul 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp ghost (hide my wp ghost)
Be the first to know when new medium vulnerabilities affecting unknown wp ghost (hide my wp ghost) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Ghost (Hide My WP Ghost)
0 < 7.0.05
References
Credits
Yaswanth Reddy Sunkara WPScan