{
 "id": "WPSEC-2026-0550",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0550/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0550/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0550/index.md",
 "title": "WP Ghost (Hide My WP Ghost) <= 7.0.12 - Unauthenticated Firewall and Brute Force Protection Bypass via Forged Login Cookie",
 "description": "The Hide My WP Ghost plugin for WordPress is vulnerable to a protection bypass in versions 7.0.00 up to, and including, 7.0.12. This is due to the firewall and brute force checks, which run before WordPress can verify login cookies, treating any request that carries a cookie named like a WordPress logged-in cookie as coming from a logged-in user without validating the cookie's signature. This makes it possible for unauthenticated attackers to add a forged login cookie to their requests and skip the plugin's firewall rules, IP ban list and threat detection, as well as its login brute force protection (attempt limits, lockouts and CAPTCHA), when those features are enabled.",
 "plugin": {
  "slug": "hide-my-wp",
  "name": "WP Ghost (Hide My WP Ghost)",
  "full_name": "Hide My WP Ghost – Security & Firewall",
  "wordpress_org": "https://wordpress.org/plugins/hide-my-wp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/hide-my-wp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/hide-my-wp"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-565"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "7.0.00",
    "from_inclusive": true,
    "to": "7.0.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 7.0.00 before 7.0.13"
  ]
 },
 "introduced_in": "7.0.00",
 "fixed_in": "7.0.13",
 "remediation": "Update to 7.0.13 or later.",
 "fix_released": "2026-10-04T17:39:44+00:00",
 "published": "2026-10-07T14:47:02+00:00",
 "updated": "2026-10-07T13:54:57.088296+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0550/",
  "https://plugins.svn.wordpress.org/hide-my-wp/tags/7.0.13/",
  "https://wordpress.org/plugins/hide-my-wp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/hide-my-wp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-07"
 }
}