The Hide My WP Ghost plugin for WordPress omits verification that client IP information originates from a trusted proxy before using attacker‑controllable HTTP headers. The flaw allows an unauthenticated attacker to forge IP addresses by sending headers such as X‑Forwarded‑For or X‑Real‑IP. By spoofing the IP, the attacker can bypass the plugin’s brute‑force protection and undermine its firewall whitelisting that depends on a hardcoded IP range. The vulnerability does not grant code execution or direct data exfiltration; its chief consequence is weakening key defensive controls, permitting prolonged credential‑guessing or potential denial‑of‑service through exhausted brute‑force counters.

All WordPress sites that have the Hide My WP Ghost plugin installed with any version earlier than 7.0.05 are affected. The flaw is present wherever the plugin is active, regardless of theme or other plugins, as long as the site remains un‑upgraded to the patched release.

Based on the description, it is inferred that the attack vector is remote: an attacker simply needs to send an HTTP request containing forged proxy headers from any external host. The CVSS score of 5.4 places the vulnerability in the moderate severity range, while the EPSS score of less than 1% indicates a low likelihood of exploitation as of now. The vulnerability is not listed in the CISA KEV catalog. Because the weakness is rooted in missing header validation, an attacker can exploit the flaw without special access or privileged network positions, thus the risk remains moderate but non‑negligible.