WP Ghost (Hide My WP Ghost) <= 7.0.12 - Insufficient Session Expiration in Temporary Logins on PHP 8
- ID
- WPSEC-2026-0551
- Plugin
- Hide My WP Ghost – Security & Firewall (hide-my-wp)
- Affected
- from 7.0.00 before 7.0.13
- Remediation
- Update to 7.0.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-613
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-07
- Attack surface
- WP Ghost (Hide My WP Ghost) on WPSec AttackSurface
- Fix released
- Published
Description
The Hide My WP Ghost plugin for WordPress is vulnerable to Insufficient Session Expiration in versions 7.0.00 up to, and including, 7.0.12. This is due to the temporary login expiry check comparing the stored expiry duration directly with the current timestamp, which on PHP 8.0 and later never starts the expiry countdown, so temporary logins never expire. This makes it possible for anyone holding a temporary login link to keep logging in with the role assigned to it (administrator by default) after the intended expiry time. The Temporary Logins feature must be enabled and the site must run on PHP 8.0 or later.
References
- https://wpsec.com/vuln/WPSEC-2026-0551/
- https://plugins.svn.wordpress.org/hide-my-wp/tags/7.0.13/
- https://wordpress.org/plugins/hide-my-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS