# CVE-2026-39484: John Darrel Hide My WP Ghost open redirect

Source: https://junglewise.ai/threats/cve-2026-39484-john-darrel-hide-my-wp-ghost-open-redirect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39484 · Severity: medium · CVSS 4.7 · Published 2026-04-08

Hide My WP Ghost is a WordPress security plugin designed to hide the fact that a website is running on WordPress to prevent automated attacks. A vulnerability in this plugin allows attackers to create malicious links that appear to belong to the trusted website but actually redirect users to external, potentially harmful sites. This can be used in phishing campaigns to steal user credentials or distribute malware by leveraging the reputation of the trusted domain.

Technologies: [John Darrel Hide My WP Ghost](https://junglewise.ai/threats/technologies/hide-my-wp-ghost). Vendors: [John Darrel](https://junglewise.ai/threats/vendors/john-darrel).

## Quick answers

**Is CVE-2026-39484 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39484 being exploited in the wild.

**How severe is CVE-2026-39484?** Medium severity, with a CVSS score of 4.7, published 8 April 2026.

**Which products and versions are affected?** John Darrel Hide My WP Ghost up to 7.0.00 (exclusive).

**Is there a fix for CVE-2026-39484?** A patch was published on 2026-03-18: Version 7.0.00 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39484 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-39484?** Check whether you run John Darrel Hide My WP Ghost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Open Redirect (CWE-601) vulnerability exists in the John Darrel Hide My WP Ghost plugin for WordPress in versions prior to 7.0.00. The issue stems from insufficient validation of user-supplied input used in redirection targets. An unauthenticated remote attacker can exploit this by crafting a URL that, when clicked by a victim, redirects them from the legitimate site to an arbitrary external domain. While the vulnerability itself does not allow for direct data theft from the server, it is a primary vector for phishing and social engineering attacks. The issue is resolved in version 7.0.00.

## Affected products

- John Darrel Hide My WP Ghost up to 7.0.00 (exclusive)

## Timeline

- 2026-02-16: other: Vulnerability reported by researcher Or Benit
- 2026-03-18: advisory: Patchstack published advisory details
- 2026-04-08: disclosed: CVE published to NVD
- 2026-03-18: patched: Version 7.0.00 released to address the issue

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/hide-my-wp/vulnerability/wordpress-hide-my-wp-ghost-plugin-7-0-00-open-redirection-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/hide-my-wp/vulnerability/wordpress-hide-my-wp-ghost-plugin-7-0-00-open-redirection-vulnerability?_s_id=cve)

## Related threats

- [Hide My WP Ghost server-side request forgery](https://junglewise.ai/threats/cve-2026-81806-hide-my-wp-ghost-server-side-request-forgery)
- [John Darrel Hide My WP Ghost authentication bypass in 2FA](https://junglewise.ai/threats/cve-2026-59546-john-darrel-hide-my-wp-ghost-authentication-bypass-in-2fa)