Description

Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-08T08:17:13.267Z",
  "pubdate": "2026-09-08T08:17:13.267Z",
  "executiveSummary": "The Hide My WP Ghost plugin for WordPress, specifically versions n/a through 7.0.09, is susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This security flaw enables a remote attacker to induce the vulnerable server into making arbitrary HTTP requests to unintended destinations, potentially including internal network resources that are otherwise inaccessible from the public internet.\nThe vulnerability arises due to improper validation of user-supplied input used by the plugin to perform requests. By manipulating the request parameters, an attacker can coerce the web server to communicate with internal services, such as internal APIs, metadata services, or databases.\nThe impact of a successful SSRF exploitation includes the exposure of internal configuration data, unauthorized interaction with private network services, and potential bypass of firewall restrictions. This could lead to information disclosure or further compromise of the underlying server infrastructure.\nThe vulnerability does not necessarily require high-level administrative privileges for initial exploitation, though the specific requirements depend on the implementation of the vulnerable functionality. Organizations utilizing Hide My WP Ghost are advised to review the affected version and prepare for immediate updates to mitigate this risk.",
  "technicalDetails": "The vulnerability identified in Hide My WP Ghost versions up to 7.0.09 is categorized as a Server-Side Request Forgery (SSRF). At its core, the vulnerability stems from the application's failure to adequately sanitize or validate input parameters that control the target URL for outbound server-side HTTP requests.\nIn the context of the WordPress plugin architecture, this flaw typically exists within administrative or utility functions intended to perform remote requests, such as fetching remote resources, validating external URLs, or interacting with third-party services. When the input provided by the user is passed directly to an underlying function responsible for issuing HTTP requests—such as wp_remote_get() or similar cURL wrappers—without a rigid allow-list of domains, an attacker can supply an arbitrary URL.\nThe attack flow proceeds as follows: 1) An attacker identifies an endpoint or parameter handled by the plugin that triggers an outbound request; 2) The attacker crafts a malicious request by modifying the target parameter to point to a local or internal IP address (e.g., http://127.0.0.1 or http://169.254.169.254 for cloud metadata services) and specifying a target port; 3) The server receives this request and, acting on behalf of the attacker, initiates the HTTP request to the specified internal target; 4) The server-side code receives the response from the internal resource and inadvertently discloses its contents back to the attacker, or provides a side-channel (e.g., through error messages or response timing) that confirms the status of the internal service.\nThis vulnerability is particularly dangerous because the requests originate from the trusted server's IP address. By bypassing network-level access controls (such as firewall rules protecting internal subnets), an attacker can probe internal network topology, scan internal ports, or access administrative interfaces that lack authentication when accessed from 'localhost'.\nGiven that the vulnerable component is active in versions 7.0.09 and below, the risk is persistent across a wide installation base. Exploitation typically does not require specialized payloads, only the ability to reach the vulnerable endpoint, which may be accessible even to low-privileged users depending on the plugin's hooks. Post-exploitation, an attacker may move laterally within the network or gather sensitive information required for further escalation, such as API keys or configuration files stored on internal services."
}