What’s Vulnerable › Vulnerabilities

CVE-2024-13794: Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-12 · updated 2026-06-17
• Weakness: CWE-693

Description

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. This is due to the plugin not properly restricting the /wp-register.php path. This makes it possible for unauthenticated attackers to discover the hidden login page location.

Affected products

• johndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall: before 5.4.01 — fixed in 5.4.01

How to fix

Upgrade to a fixed version: johndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall 5.4.01. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3235271%40hide-my-wp&new=3235271%40hide-my-wp&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9effa526-7454-4490-9bf4-0605254d6625?source=cve

Get alerted when CVE-2024-13794 or the next vulnerability affects your stack