CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows PHP Local File Inclusion.This issue affects Hide My WP Ghost: from n/a through <= 5.4.01.
Explanation of Vulnerability in Simple Terms
Hide My WP Ghost versions 5.4.01 and earlier contain a vulnerability that allows attackers to execute arbitrary code on affected sites. The vulnerability requires user interaction—typically a victim must click a malicious link or visit an attacker-controlled page. The impact extends beyond the plugin itself, potentially compromising the entire WordPress installation. No patched version is currently available.
What an attacker can do
Run arbitrary code on the WordPress site and access sensitive data.
Potential impact on your site
Complete compromise of the WordPress site, including data theft and unauthorized modifications.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page; no authentication required.
Key dates
External resources
Related vulnerabilities
