What is GHSA-49jm-q6q7-76gc?

GHSA-49jm-q6q7-76gc is a security advisory published by GitHub Security Advisories with Medium severity. The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP...

Which CVE IDs does GHSA-49jm-q6q7-76gc cover?

GHSA-49jm-q6q7-76gc covers the following CVE IDs: CVE-2026-11870. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-49jm-q6q7-76gc?

GHSA-49jm-q6q7-76gc has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-49jm-q6q7-76gcMediumCVSS 5.4

The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP...

Vendor

GitHub Security Advisories

Published

July 30, 2026

Last Modified

July 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-11870 →

📋 Description

The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-11870
https://wpscan.com/vulnerability/d3bf6487-88a9-4fc7-87b6-5e739519aa64
https://github.com/advisories/GHSA-49jm-q6q7-76gc