The WP Ghost (Hide My WP Ghost) WordPress plugin versions prior to 7.0.05 do not properly validate that client IP addresses come from trusted proxies before relying on HTTP headers for IP information. This flaw enables unauthenticated attackers to spoof their IP address via attacker-controlled HTTP headers. By doing so, attackers can bypass the plugin's brute-force protection mechanisms and reduce the effectiveness of its firewall by appearing to originate from a hardcoded whitelisted IP range.

An unauthenticated attacker can spoof their IP address to bypass brute-force protection and firewall restrictions implemented by the WP Ghost plugin. This could allow attackers to conduct brute-force attacks or other malicious activities that the plugin is designed to prevent, potentially increasing the risk of unauthorized access or other security issues on the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 7.0.05 or later once available, as this version is indicated as the fixed version. Until then, consider restricting access to trusted IP ranges at the network level or disabling the affected plugin if feasible.