The Hide My WP Ghost plugin for WordPress is affected by an authentication bypass flaw, which could allow an unauthenticated attacker to gain unauthorized access to protected features.

The plugin suffers from an authorization bypass via user-controlled keys (CWE-639). This vulnerability allows an unauthenticated attacker to manipulate parameters to bypass security controls, as indicated by the CVSS vector AV:N/PR:N.

Successful exploitation allows an attacker to bypass authentication mechanisms, potentially leading to unauthorized administrative actions or data exposure. With a CVSS score of 7.4, this vulnerability represents a significant risk to the integrity and confidentiality of the WordPress environment.

Immediate Action: Update the Hide My WP Ghost plugin to version 7.0.07 or later immediately to resolve the underlying authorization flaw.

Proactive Monitoring: Review WordPress access logs for unusual administrative activity or requests originating from unexpected IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting plugin authentication parameters.

Public Exploit Available: No

Given the high severity of this authentication bypass, administrators must prioritize updating the plugin to the latest version. Failure to remediate this vulnerability leaves the application susceptible to unauthorized access and potential compromise of critical site settings.