WordPress Plugin Vulnerabilities

WP Ghost (Hide My WP Ghost) < 7.0.10 - Unauthenticated SSRF

Description

The plugin is vulnerable to Server-Side Request Forgery, making it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
hide-my-wp
Fixed in 7.0.10

References

CVE
CVE-2026-81806
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4ae328-5aae-435c-af23-b5ffd56bd83a

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.8 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
1b382135-b1d7-4e73-bdcb-6b9c8b9d2c60

Timeline

Publicly Published
2026-09-07 (about 14 days ago)
Added
2026-09-10 (about 11 days ago)
Last Updated
2026-09-10 (about 11 days ago)

Other

Published
Title
Published
2024-01-08
Title
Contact Form 7 Extension For Mailchimp < 0.9.19 - Subscriber+ Server-Side Request Forgery
Published
2024-07-11
Title
Magical Addons For Elementor < 1.1.42 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2026-06-04
Title
Essential Blocks < 6.1.4 - Author+ Server-Side Request Forgery via AI Image Generation
Published
2026-02-19
Title
URL Shortify < 1.12.4 - Authenticated (Author+) Server-Side Request Forgery
Published
2025-02-17
Title
ProfileGrid – User Profiles, Groups and Communities < 5.9.4.3 - Authenticated (Subscriber+) Limited Server-Side Request Forgery