Is CVE-2026-86800 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86800 being exploited in the wild.

How severe is CVE-2026-86800?

Medium severity, with a CVSS score of 5.3, published 18 September 2026.

Which products and versions are affected?

WP Ghost Hide My WP Ghost before 7.0.11.

Is there a fix for CVE-2026-86800?

A patch was published on 2026-09-?: Version 7.0.11 contains the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86800 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86800?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86800: Hide My WP Ghost WordPress plugin authentication bypass

CVE-2026-86800 · Severity: medium · CVSS 5.3 · Published 2026-09-18

Hide My WP Ghost is a WordPress plugin that conceals the location of the WordPress login page and other sensitive URLs to prevent brute-force attacks. A vulnerability in versions before 7.0.11 allows attackers to bypass the security checks protecting this hidden login page by submitting a specially crafted loopback verification request with incorrect or missing credentials, re-exposing the concealed login URL to anyone visiting the site.

Quick answers

Is CVE-2026-86800 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86800 being exploited in the wild.
How severe is CVE-2026-86800?: Medium severity, with a CVSS score of 5.3, published 18 September 2026.
Which products and versions are affected?: WP Ghost Hide My WP Ghost before 7.0.11.
Is there a fix for CVE-2026-86800?: A patch was published on 2026-09-?: Version 7.0.11 contains the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86800 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86800?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in the plugin's loopback security-check mechanism. The plugin fails to properly validate the verification token on requests that are intended to check server connectivity from the local machine; an attacker can trigger these checks with invalid or missing verification values, causing the plugin to temporarily disable its login and URL hiding protection. This is a logic flaw in the security check conditional, allowing unauthenticated, network-reachable attackers to re-expose the hidden WordPress login page location. The vulnerability was patched in version 7.0.11.

Affected products

WP Ghost Hide My WP Ghost before 7.0.11

Timeline

2026-09-16: disclosed
2026-09-?: patched: Version 7.0.11 contains the fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.