CVE-2024-13794

published 2025-02-12

CVE-2024-13794: The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02…

Priority P4 28 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C L I N A N

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. This is due to the plugin not properly restricting the /wp-register.php path. This makes it possible for unauthenticated attackers to discover the hidden login page location.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
johndarrel	wp_ghost_security_firewall	<= 5.3.02	—
wpplugins	hide_my_wp_ghost	< 5.4.01	5.4.01

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-693