CVE-2026-86796CWE-693

CVE-2026-86796

Medium · published September 18, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00345 · 26.7th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-09-18T11:16Z
References (1)
https://wpscan.com/vulnerability/38baa866-c8a3-4c92-b7c8-8485e7c2a9b0/ · [email protected]
EPSS history
Timeline
  • 19 SEP 03:54Z
    EPSS moved — → 0%
    epss
  • 18 SEP 06:11Z
    WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters
    cvelistv5