CVE-2026-11870: CWE-290 Authentication Bypass by Spoofing in WP Ghost (Hide My WP Ghost)
The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.
AI Analysis
Technical Summary
The WP Ghost (Hide My WP Ghost) WordPress plugin versions prior to 7.0.05 do not properly validate that client IP addresses come from trusted proxies before trusting HTTP headers that can be controlled by attackers. This lack of verification permits unauthenticated attackers to spoof their IP address, thereby bypassing the plugin's brute-force protection mechanisms and reducing the effectiveness of its firewall by exploiting a hardcoded whitelist of IP ranges.
Potential Impact
Unauthenticated attackers can bypass brute-force protection and firewall restrictions implemented by the WP Ghost plugin, potentially allowing them to conduct unauthorized access attempts or evade security controls designed to protect the WordPress site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the plugin or implementing additional network-level protections to prevent IP spoofing. Monitor vendor channels for updates regarding a patch or official mitigation.
CVE-2026-11870: CWE-290 Authentication Bypass by Spoofing in WP Ghost (Hide My WP Ghost)
Description
The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.
CVSS v3.1
Score 5.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP Ghost (Hide My WP Ghost) WordPress plugin versions prior to 7.0.05 do not properly validate that client IP addresses come from trusted proxies before trusting HTTP headers that can be controlled by attackers. This lack of verification permits unauthenticated attackers to spoof their IP address, thereby bypassing the plugin's brute-force protection mechanisms and reducing the effectiveness of its firewall by exploiting a hardcoded whitelist of IP ranges.
Potential Impact
Unauthenticated attackers can bypass brute-force protection and firewall restrictions implemented by the WP Ghost plugin, potentially allowing them to conduct unauthorized access attempts or evade security controls designed to protect the WordPress site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the plugin or implementing additional network-level protections to prevent IP spoofing. Monitor vendor channels for updates regarding a patch or official mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-10T12:15:36.157Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6aee069c2644c7f8a7eedb
Added to database: 07/30/2026, 06:24:06 UTC
Last enriched: 07/30/2026, 07:09:12 UTC
Last updated: 07/30/2026, 23:37:05 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.