WP Ghost (Hide My WP Ghost) – Security & Firewall

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WP Ghost (Hide My WP Ghost) – Security & Firewall

Information

Software Type Plugin
Software Slug hide-my-wp (view on wordpress.org)
Software Status Active
Software Author johndarrel
Software Website wordpress.org
Software Downloads 2,729,522
Software Active Installs 100,000
Software Record Last Updated August 8, 2026

9 Vulnerabilities

Submit a Vulnerability
WP Ghost (Hide My WP Ghost) – Security & Firewall <= 7.0.06 - Two-Factor Authentication Bypass
4.3
CVE-2026-59546
Jul 23, 2026
Researcher: Ananda Dhakal
Hide My WP Ghost < 7.0.00 - Unauthenticated Open Redirect
4.7
CVE-2026-39484
Mar 18, 2026
Researcher: Or Benit
Hide My WP Ghost <= 5.4.01 - Unauthenticated Local File Inclusion
9.8
CVE-2025-26909
Mar 19, 2025
Researcher: Dimas Maulana
WP Ghost <= 5.4.01 - Unauthenticated Limited File Read
7.5
CVE-2025-2056
Mar 13, 2025
Researcher: mikemyers
Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure
5.3
CVE-2024-13794
Feb 11, 2025
Researcher: Nicholas Mun (NRockhouse)
Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL
6.1
CVE-2024-10825
Nov 14, 2024
Researcher: Peter Thaleikis
Hide My WP Ghost – Security & Firewall <= 5.2.01 - Login Page Disclosure
5.3
CVE-2024-6420
Jul 2, 2024
Researcher: Juan Pablo Gomez Postigo
Hide My WP Ghost <= 5.0.25 - CAPTCHA Bypass in brute_math_authenticate
5.3
CVE-2023-34001
Aug 22, 2023
Researcher: konagash
Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass
6.5
CVE-2022-4537
May 8, 2023
Researcher: rezaduty
Title Status CVE ID CVSS Researchers Date
WP Ghost (Hide My WP Ghost) – Security & Firewall <= 7.0.06 - Two-Factor Authentication Bypass Patched CVE-2026-59546 4.3 Ananda Dhakal July 23, 2026
Hide My WP Ghost < 7.0.00 - Unauthenticated Open Redirect Patched CVE-2026-39484 4.7 Or Benit March 18, 2026
Hide My WP Ghost <= 5.4.01 - Unauthenticated Local File Inclusion Patched CVE-2025-26909 9.8 Dimas Maulana March 19, 2025
WP Ghost <= 5.4.01 - Unauthenticated Limited File Read Patched CVE-2025-2056 7.5 mikemyers March 13, 2025
Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure Patched CVE-2024-13794 5.3 Nicholas Mun (NRockhouse) February 11, 2025
Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL Patched CVE-2024-10825 6.1 Peter Thaleikis November 14, 2024
Hide My WP Ghost – Security & Firewall <= 5.2.01 - Login Page Disclosure Patched CVE-2024-6420 5.3 Juan Pablo Gomez Postigo July 2, 2024
Hide My WP Ghost <= 5.0.25 - CAPTCHA Bypass in brute_math_authenticate Patched CVE-2023-34001 5.3 konagash August 22, 2023
Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass Patched CVE-2022-4537 6.5 rezaduty May 8, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation