What’s Vulnerable › Vulnerabilities

CVE-2024-6420: Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-07-23 · updated 2026-06-17

Description

The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.

Affected products

• johndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall: before 5.2.02 — fixed in 5.2.02

How to fix

Upgrade to a fixed version: johndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall 5.2.02. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/dfda6577-81aa-4397-a2d6-1d736f9ebd44/
• https://wpscan.com/vulnerability/dfda6577-81aa-4397-a2d6-1d736f9ebd44/

Get alerted when CVE-2024-6420 or the next vulnerability affects your stack