CVE-2026-86800
Medium
Description
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.
SeverityMedium
CVSS5.3
Exploit probability—
ProductHide My WP Ghost
PublishedSep 18, 2026
First seenSep 18, 2026
Weakness typeCWE-693CWE-693
How to fix
Update
- Hide My WP Ghost7.0.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Hide My WP Ghost | v < 7.0.11 | 7.0.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.