The vulnerability identified as CVE-2026-39484 affects the Hide My WP Ghost plugin by John Darrel. It is an Open Redirect issue where the application improperly handles URL redirection, allowing attackers to redirect users to untrusted external websites. This can be leveraged for phishing attacks by tricking users into visiting malicious sites. The vulnerability affects all versions before 7.0.00. The CVSS 3.1 base score is 4.7, indicating medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality impact. No official patch or remediation level has been published by the vendor as of the data provided.

The primary impact of this vulnerability is the potential for phishing attacks through malicious URL redirection. Confidentiality is slightly impacted due to possible user redirection to untrusted sites, but there is no direct impact on integrity or availability. There are no known active exploits in the wild, reducing immediate risk. However, users of affected versions may be exposed to social engineering risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with URLs generated by the plugin and consider implementing additional URL validation or filtering at the application or web server level to prevent open redirects. Monitoring vendor channels for updates is recommended.