WordPress Plugin Vulnerabilities

WP Ghost (Hide My WP Ghost) – Security & Firewall < 7.0.07 - Two-Factor Authentication Bypass

Description

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 7.0.06. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass 2FA.

Affects Plugins

Plugin icon
hide-my-wp
Fixed in 7.0.07

References

CVE
CVE-2026-59546
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c85a2d47-cabe-4c0b-b329-af93163d3771

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
8435552c-d277-4cbc-b3e7-ae98b78d1b78

Timeline

Publicly Published
2026-07-23 (about 1 month ago)
Added
2026-07-29 (about 1 month ago)
Last Updated
2026-07-29 (about 1 month ago)

Other

Published
Title
Published
2018-11-27
Title
Woo Confirmation Email < 3.2.0 - Missing Access Controls to View Uploaded files
Published
2019-12-12
Title
Ultimate Addons for Beaver Builder <= 1.24.0 - Authentication Bypass
Published
2023-07-18
Title
OAuth Single Sign On – SSO (OAuth Client) < 6.23.4 - Improper Authentication
Published
2026-01-16
Title
Registration & Login with Mobile Phone Number for WooCommerce < 1.3.2 - Authentication Bypass
Published
2025-11-18
Title
YITH WooCommerce Wishlist < 4.10.1 - Wishlist Item Deletion via Wishlist Token Disclosure