IP Spoofing in Hide My WP Ghost WordPress Plugin

Executive Summary

CVE-2026-11870 affects the Hide My WP Ghost WordPress plugin before version 7.0.05. It allows unauthenticated attackers to spoof their IP address by exploiting untrusted HTTP headers like CF-Connecting-IP. This bypasses the plugin's brute-force protection and firewall by either rotating spoofed IPs behind a proxy or using a hardcoded whitelisted IP range (192.0.64.0/18) to downgrade security filters.

Useful 0 Not Useful 0

Detection Guidance

Check if your Hide My WP Ghost plugin version is below 7.0.05. Inspect server logs for unusual IP addresses in HTTP headers like CF-Connecting-IP or X-Forwarded-For that bypass normal proxy checks. Look for repeated failed login attempts from whitelisted IP ranges (192.0.64.0/18).

Commands: grep -r "CF-Connecting-IP" /var/log/nginx/ or /var/log/apache2/. Check plugin version via WordPress admin panel or run wp plugin list in WP-CLI.

Useful 0 Not Useful 0

Impact Analysis

Attackers could bypass brute-force protection to repeatedly attempt logins, potentially gaining unauthorized access. If behind a proxy or CDN, they can manipulate IP tracking to avoid lockouts. Without a proxy, they can exploit the whitelisted IP range to disable firewall filters and make unlimited failed login attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Hide My WP Ghost plugin to version 7.0.05 or later immediately. Review server configurations to ensure trusted proxy headers are properly validated. Block or monitor traffic from the whitelisted IP range (192.0.64.0/18) if suspicious activity is detected.

Useful 0 Not Useful 0