# WP Ghost (Hide My WP Ghost) <= 7.0.12 - Insufficient Session Expiration in Temporary Logins on PHP 8

- **ID:** WPSEC-2026-0551
- **Plugin:** Hide My WP Ghost – Security & Firewall (`hide-my-wp`), https://wordpress.org/plugins/hide-my-wp/
- **Affected versions:** from 7.0.00 before 7.0.13
- **Fixed in:** 7.0.13 (Update to 7.0.13 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-613
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/hide-my-wp
- **Fix released:** 2026-10-04
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0551/

## Description

The Hide My WP Ghost plugin for WordPress is vulnerable to Insufficient Session Expiration in versions 7.0.00 up to, and including, 7.0.12. This is due to the temporary login expiry check comparing the stored expiry duration directly with the current timestamp, which on PHP 8.0 and later never starts the expiry countdown, so temporary logins never expire. This makes it possible for anyone holding a temporary login link to keep logging in with the role assigned to it (administrator by default) after the intended expiry time. The Temporary Logins feature must be enabled and the site must run on PHP 8.0 or later.

## References

- https://wpsec.com/vuln/WPSEC-2026-0551/
- https://plugins.svn.wordpress.org/hide-my-wp/tags/7.0.13/
- https://wordpress.org/plugins/hide-my-wp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0551/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.