Security Alert Summary
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress contains an open redirect vulnerability in all versions up to and including 7.0.02. The plugin does not properly validate user input, which can allow an attacker to craft a logout URL that redirects a logged-in user to a malicious site after the victim is logged out via wp_logout(). Exploitation requires tricking a logged-in user into clicking a specially crafted link.
CVE Details
- CVE ID: CVE-2026-7527
- Affected component: WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress
- Affected versions: All versions up to and including 7.0.02
- Published: September 19, 2026, 8:16:54 AM UTC
- Last modified: September 19, 2026, 2:16:59 PM UTC
- CVSS v3.1 base score: 4.7 (MEDIUM)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - Authentication / privileges / user interaction:
- Authentication required: None
- Privileges required: None
- User interaction: Required
- Primary impact:
- Confidentiality: None
- Integrity: Low
- Availability: None
- Weakness (CWE): CWE-601 (Open Redirect)
Technical Details
This vulnerability is an open redirect stemming from insufficient validation of user-supplied input in the plugin. An attacker can construct a specially crafted logout URL that, when clicked by a logged-in user, triggers the plugin to perform a redirect to an attacker-controlled site after calling wp_logout(). Because the logout occurs before the redirect, the victim is logged out as part of the attack chain and the redirect cannot be reversed by the plugin at that point.
The issue exists because the plugin does not enforce proper validation or allowlist checks on the destination URL provided in the logout flow. The behavior results in a redirect to an arbitrary external location under attacker control if the victim follows the crafted link. No additional vectors, REST endpoints, or functions are named beyond wp_logout() in the available details.
Impact is limited to the ability to log a user out and redirect them to another site. The CVSS metrics indicate no direct confidentiality loss from the vulnerability itself, with a low integrity impact due to potential unauthorized redirection.
How This Could Impact Your Website
Consider a small site with a site owner, an editor on the internal staff, and an external contractor who occasionally contributes content. An attacker could send a targeted message to the editor or contractor containing a link that appears to be a legitimate logout. If the recipient is logged in and clicks the link, they would be logged out and redirected to an external site controlled by the attacker. While the vulnerability does not directly disclose stored data (CVSS confidentiality: None), this type of redirect can be used as part of a phishing or social engineering campaign to collect credentials or deliver malicious content.
Practical consequences include increased risk of targeted phishing against staff, confusion or disruption for users who are unexpectedly logged out, and potential reputational impact if visitors are redirected to malicious pages. If you re-use credentials across services or if redirected pages attempt to harvest information, the overall risk rises.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege accounts that are frequently used.
- Enforce strong, unique passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from sites to reduce attack surface.
- Monitor site activity and access logs for unusual behavior, including unexpected logout and redirect patterns.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.5.02/models/Rewrite.php#L1679
- https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.5.02/models/Rewrite.php#L1684
- https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/7.0.01/models/Rewrite.php#L1679
- https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/7.0.01/models/Rewrite.php#L1684
- https://plugins.trac.wordpress.org/browser/hide-my-wp/trunk/models/Rewrite.php#L1679
- https://plugins.trac.wordpress.org/browser/hide-my-wp/trunk/models/Rewrite.php#L1684
- https://plugins.trac.wordpress.org/changeset/3556343
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bd88ebd2-5584-4886-9c85-39a225cd00e9?source=cve
