CVE-2026-39484 MEDIUM

CVE-2026-39484: WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerability

Vendor John Darrel

Product Hide My WP Ghost

Weakness CWE-601 · Open redirect

Published April 8, 2026

Last update April 29, 2026

View on NVD All CVEs

CVSS base score

4.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00.

Explanation of Vulnerability in Simple Terms

02Summary

Hide My WP Ghost versions 7.0.00 and earlier contain an open redirect vulnerability. An attacker can craft a malicious link that redirects users to an external website when clicked. The vulnerability requires user interaction and affects the scope of the application. Low confidentiality impact is possible.

What an attacker can do

03Attacker Capabilities

Redirect site visitors to a malicious external website via a crafted link.

Potential impact on your site

04Site Impact

Users may be phished or redirected to malware sites, damaging site reputation and user trust.

Conditions required to exploit

05Prerequisites

Victim must click an attacker-supplied link; no authentication required.

Key dates

06Disclosure timeline

April 8, 2026 CVE published

April 29, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-39484 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/601.html AskarLabs — CWE-601 write-up URL Redirection to Untrusted Site (Open Redirect)

Related vulnerabilities