Executive brief
A security plugin for WordPress, designed to hide the site's identity and prevent brute-force attacks, fails to properly verify the source of network traffic. This allows an attacker to pretend they are connecting from a trusted location, such as a whitelisted service like Jetpack. By doing so, they can bypass the plugin's security filters and brute-force login credentials without being blocked or detected.
Technical details
The Hide My WP Ghost plugin fails to validate if client IP information originates from a trusted proxy before trusting HTTP headers like 'CF-Connecting-IP'. An unauthenticated attacker can provide a spoofed IP address in these headers. If the spoofed IP falls within a hardcoded whitelisted range (such as the Jetpack range 192.0.64.0/18), the 'isWhitelistedIP()' function returns true, suppressing the firewall, threat detection, and brute-force lockout mechanisms. Additionally, attackers can rotate spoofed IPs to gain infinite login attempts by ensuring each spoofed identity receives a fresh rate-limit window. This issue is fixed in version 7.0.05.
Affected products
- Squirrly Hide My WP Ghost (WP Ghost) < 7.0.05
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-30: advisory: NVD publication date
- 7.0.05: patched