A vulnerability in the Hide My WP Ghost plugin for WordPress allows an attacker to redirect users to an arbitrary, untrusted website. This open redirection flaw can be employed to deliver phishing pages, spread malware, or facilitate credential theft. The weakness is identified as CWE‑601 and affects the plugin's internal URL handling logic.

The issue impacts the WordPress Hide My WP Ghost plugin developed by John Darrel. All versions prior to 7.0.00 are affected. No specific minor revisions are listed, so any release before the 7.0.00 line is vulnerable.

The CVSS score is 4.7, indicating moderate severity, while the EPSS score is below 1%, suggesting a low probability of exploit. The vulnerability is not catalogued in the CISA Known Exploited Vulnerabilities list. The most likely attack vector is a crafted URL that leverages the plugin’s redirect feature; based on the description, this is inferred rather than explicitly stated.