CVE-2026-86796

Name of the Vulnerable Software and Affected Versions Hide My WP Ghost versions prior to 7.0.11

Description The plugin fails to verify if a request is a genuine WooCommerce request before disabling its firewall, threat-detection, and login/URL-hiding protections. An unauthenticated attacker can trigger this by providing a specific request parameter, which disables these security features and re-exposes the concealed login and admin URLs on any request.

Recommendations Update Hide My WP Ghost to version 7.0.11 or later.