WP Ghost (Hide My WP Ghost) <= 7.0.11 - Unauthenticated Login CAPTCHA Bypass via 'woocommerce-login-nonce' Parameter
- ID
- WPSEC-2026-0118
- Plugin
- Hide My WP Ghost – Security & Firewall (hide-my-wp)
- Affected
- all versions before 7.0.12
- Remediation
- Update to 7.0.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-307
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- WP Ghost (Hide My WP Ghost) on WPSec AttackSurface
- Fix released
- Published
Description
The WP Ghost (Hide My WP Ghost) plugin for WordPress is vulnerable to a login CAPTCHA bypass in versions up to, and including, 7.0.11. When Brute Force Protection is enabled with its WooCommerce Support option turned off (the default) and WooCommerce is active, the plugin's WooCommerce compatibility code switched off its entire pre-authentication check for any request carrying a 'woocommerce-login-nonce' parameter. In versions up to 7.0.09 any non-empty value was enough. Versions 7.0.10 and 7.0.11 require a valid nonce, which any visitor can read from the public My Account login form, but that check only takes effect when another plugin has loaded WordPress's pluggable functions before WP Ghost loads, so it is normally inactive in those two versions. This makes it possible for unauthenticated attackers to send login attempts, for example to wp-login.php, without solving the reCAPTCHA or math CAPTCHA and without triggering the immediate block on invalid usernames. The failed-attempt counter and IP lockout still apply. Version 7.0.12 limits the exemption to the CAPTCHA on WooCommerce's own login form and never applies it on wp-login.php or xmlrpc.php.
References
- https://wpsec.com/vuln/WPSEC-2026-0118/
- https://plugins.svn.wordpress.org/hide-my-wp/tags/7.0.12/
- https://wordpress.org/plugins/hide-my-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS