PULSE
LIVE30signals / 24h
ES
FEED
ransomcmdorganization reclama a Contact Group · AU · Professional Servicesransomincransom reclama a sslf.local · US · Not Foundransomqilin reclama a TenSparrows · US · Not Foundransomcmdorganization reclama a Collge Mont Notre-Dame de Sherbrooke · CA · Educationransomqilin reclama a Db Tarimsal Enerji · TR · Agriculture and Food Productionransomcmdorganization reclama a Rondout Electric · US · Energy & Utilitiesransomqilin reclama a Byonyks · US · Technologyransomqilin reclama a Prenisac · US · Not Foundransomqilin reclama a Excel Consultores · MX · Professional Servicesransomqilin reclama a Affinity Capital · US · Financial Servicesransomkairos reclama a Warwick Fabrics · NZ · Manufacturingransomgunra reclama a Siam Stabilizers and Chemicals Co., Ltd. / SSC · TH · Manufacturingransomqilin reclama a Adpo · Otherransomqilin reclama a servitelco · CL · Technologyransomcmdorganization reclama a Contact Group · AU · Professional Servicesransomincransom reclama a sslf.local · US · Not Foundransomqilin reclama a TenSparrows · US · Not Foundransomcmdorganization reclama a Collge Mont Notre-Dame de Sherbrooke · CA · Educationransomqilin reclama a Db Tarimsal Enerji · TR · Agriculture and Food Productionransomcmdorganization reclama a Rondout Electric · US · Energy & Utilitiesransomqilin reclama a Byonyks · US · Technologyransomqilin reclama a Prenisac · US · Not Foundransomqilin reclama a Excel Consultores · MX · Professional Servicesransomqilin reclama a Affinity Capital · US · Financial Servicesransomkairos reclama a Warwick Fabrics · NZ · Manufacturingransomgunra reclama a Siam Stabilizers and Chemicals Co., Ltd. / SSC · TH · Manufacturingransomqilin reclama a Adpo · Otherransomqilin reclama a servitelco · CL · Technology
← All CVEs
CVE WatchJul 30, 2026

CVE-2026-11870

The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Jul 30, 2026 · Last modified: Jul 30, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.

Official references
Related CVEs

No related CVEs by CWE or product.