What is CVE-2026-86800?

CVE-2026-86800 is a medium-severity vulnerability in Hide My Wp Ghost, classified under Protection Mechanism Failure. CVSS score: 5.3/10. Published 2026-09-18.

How severe is CVE-2026-86800?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Hide My Wp Ghost

CVE-2026-86800

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Unknown Hide My Wp Ghost

Weakness classification (CWE)

CWE-693 — Protection Mechanism Failure

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-86800?: CVE-2026-86800 is a medium-severity vulnerability in Hide My Wp Ghost, classified under Protection Mechanism Failure. CVSS score: 5.3/10. Published 2026-09-18.
How severe is CVE-2026-86800?: Medium severity. CVSS v3 base score is 5.3 out of 10.