IP Spoofing Vulnerability in WP Ghost Plugin Affects WordPress Sites
CVE-2026-11870
Currently unrated
What is CVE-2026-11870?
The WP Ghost (Hide My WP Ghost) WordPress plugin prior to version 7.0.05 fails to properly verify that the client IP address originates from a trusted proxy. This oversight allows attackers to manipulate HTTP headers to spoof their IP addresses. As a result, unauthenticated attackers can circumvent the plugin's brute-force protection and potentially weaken its firewall by aligning with hardcoded whitelisted IP ranges, posing a significant security risk for affected WordPress installations.
Affected Version(s)
WP Ghost (Hide My WP Ghost) 0 < 7.0.05
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.