medium5.4
CVE-2026-11870
The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-c…
Impact
The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.
Affected products
| Product | Affected versions |
|---|---|
| WP Ghost (Hide My WP Ghost) WordPress Plugin | before 7.0.05 |
Versions were read from the advisory text. No structured product data has been published for this record yet.