Description

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-19T08:16:54.623Z",
  "pubdate": "2026-09-19T08:16:54.623Z",
  "executiveSummary": "The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin is affected by an Open Redirect vulnerability in versions up to and including 7.0.02. This vulnerability stems from improper validation of user-supplied input used within the plugin's redirection logic. An unauthenticated attacker can exploit this flaw to redirect authenticated WordPress users to arbitrary, potentially malicious third-party domains. The attack sequence is triggered when an attacker successfully induces a logged-in user to interact with a specifically crafted malicious URL. Successful exploitation results in the immediate and irreversible termination of the victim's session via wp_logout(), followed by a redirection to an external site. This vulnerability poses significant phishing and social engineering risks, as attackers can leverage the trusted context of the legitimate site to navigate users toward malicious payloads or credential-harvesting platforms.",
  "technicalDetails": "The vulnerability resides in the way the WP Ghost plugin handles redirection parameters following the logout process. By failing to implement sufficient validation or sanitization on the redirect target, the plugin allows user-supplied data to influence the destination URI. The flaw effectively bypasses expected security controls by allowing the redirection to traverse outside the trusted administrative or site domain boundaries.\nThe attack flow initiates when an unauthenticated attacker crafts a URL containing a malicious redirect parameter. This URL is designed to target the logout functionality of the WordPress application, which the plugin monitors or intercepts. When the victim, who must have an active session, clicks the crafted link, the server-side code executes the logout process via the wp_logout() function. Because the function is invoked as part of the redirection routine, the user's session is destroyed immediately, leaving the user in an unauthenticated state on the WordPress installation.\nFollowing the termination of the session, the vulnerable plugin code processes the unsanitized input to perform the redirect. Since the input was not validated against an allowed list of destinations or origin checks, the browser is instructed to navigate to the attacker-controlled URI. The victim is consequently pushed away from the legitimate site to an external domain of the attacker's choosing. This redirection is technically significant because it utilizes the site's own logout flow to maintain the appearance of legitimacy until the final transition occurs.\nThe vulnerability affects all versions up to and including 7.0.02. Exploitation does not require prior authentication or elevated privileges from the attacker; however, it strictly requires the victim to be authenticated to the WordPress instance at the time of the link interaction. The impact is primarily centered on the ability to conduct sophisticated phishing campaigns, where the victim believes they are interacting with the genuine plugin or site infrastructure, subsequently redirecting them to malicious content or deceptive pages while their active session is simultaneously revoked, preventing immediate recovery or re-authentication on the current page."
}