GCVE - cpe:2.3:a:wpplugins:hide_my_wp_ghost:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:wpplugins:hide_my_wp_ghost:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Wpplugins (`fadc2ceb-aab9-5afe-98c1-701f4a84e61e`)
Product	Hide My Wp Ghost (`61536dba-56c4-52a0-aaa2-89ec726bdfe5`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/wpplugins/hide-my-wp`	purl2cpe	2026-06-01 10:13:44.568776

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-2056`	vulnerable	2026-06-08 07:14:57.843142	WP Ghost <= 5.4.01 - Unauthenticated Limited File Read HIGH (7.5) The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. This makes it possible for unauthenticated attackers to read the contents of specific file types on the server, which can contain sensitive information. Published: 2025-03-14T04:22:34.842Z Updated: 2026-04-08T17:33:05.692Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/f43db496-80ea-442c-9417-7aa03ec95f02?source=cve https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.4.02/models/Files.php#L336	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-26909`	vulnerable	2026-06-08 07:14:50.657500	WordPress Hide My WP Ghost plugin <= 5.4.01 - Local File Inclusion to RCE vulnerability CRITICAL (9.6) Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows PHP Local File Inclusion.This issue affects Hide My WP Ghost: from n/a through <= 5.4.01. Published: 2025-03-27T15:48:49.350Z Updated: 2026-04-28T16:11:43.806Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/hide-my-wp/vulnerability/wordpress-hide-my-wp-ghost-plugin-5-4-01-local-file-inclusion-to-rce-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-6420`	vulnerable	2026-06-08 06:58:19.393233	Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page. Published: 2024-07-23T06:00:03.289Z Updated: 2025-08-27T12:00:48.445Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/dfda6577-81aa-4397-a2d6-1d736f9ebd44/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-13794`	vulnerable	2026-06-08 06:25:38.512726	Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure MEDIUM (5.3) The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. This is due to the plugin not properly restricting the /wp-register.php path. This makes it possible for unauthenticated attackers to discover the hidden login page location. Published: 2025-02-12T07:35:39.178Z Updated: 2026-04-08T17:11:53.068Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/9effa526-7454-4490-9bf4-0605254d6625?source=cve https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3235271%40hide-my-wp&new=3235271%40hide-my-wp&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-10825`	vulnerable	2026-06-08 06:23:47.655308	Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL MEDIUM (6.1) The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link. Published: 2024-11-15T06:48:04.243Z Updated: 2026-04-08T17:20:39.604Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/c467a634-d5cf-4e80-9a64-009cdad2a684?source=cve https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.3.01/classes/Tools.php#L633 https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.3.01/classes/Tools.php#L638 https://plugins.trac.wordpress.org/changeset/3186489/hide-my-wp/trunk/classes/Tools.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-34001`	vulnerable	2026-06-08 06:06:24.179808	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-4537`	vulnerable	2026-06-08 05:51:59.703917	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.