CVE-2026-7527: WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wplogout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPressto a version that resolves this vulnerability.Fixed in 7.0.02 - Configuration
Mitigate the unauthenticated Open Redirect by ensuring the plugin properly validates the 'redirect_to' parameter before using it for redirects (the vulnerability is that user input is not properly validated).
WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress redirect_to parameter = properly validate user input (block/validate redirect_to values to prevent open redirects)
Event History
Frequently Asked Questions
Who can exploit this issue, and what must they do?
No authentication is required for the attacker. They must persuade a currently logged-in WordPress user to click a specially crafted logout URL containing a malicious redirect target.
What happens to a user who follows an exploit link?
The user is logged out through wp_logout() before the redirect occurs, then sent to the attacker-controlled destination. The logout is irreversible within the attack chain.
Which plugin versions are affected?
All WP Ghost (Hide My WP Ghost) – Security & Firewall plugin versions up to and including 7.0.02 are affected.