Threat Investigation
Request a demo

CVE-2026-86796

Medium

Description

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.

SeverityMedium
CVSS5.3
Exploit probability—
ProductHide My WP Ghost
PublishedSep 18, 2026
First seenSep 18, 2026
Weakness typeCWE-693CWE-693

How to fix

Update
  • Hide My WP Ghost7.0.11 or later

Affected products

ProductAffected versionsFixed in
Hide My WP Ghost7.0.10 ≤ v < 7.0.117.0.11

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.