Kenny

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.

**Name of the Vulnerable Software and Affected Versions** Hide My WP Ghost versions prior to 7.0.11 **Description** The plugin fails to verify if a request is a genuine WooCommerce request before disabling its firewall, threat-detection, and login/URL-hiding protections. An unauthenticated attacker can trigger this by providing a specific request parameter, which disables these security features and re-exposes the concealed login and admin URLs on any request. **Recommendations** Update Hide My WP Ghost to version 7.0.11 or later.