The Hide My WP Ghost plugin contains an open redirection vulnerability that permits attackers to craft URLs which redirect users to malicious sites, facilitating phishing campaigns. The flaw exists whenever a redirect parameter without proper validation is processed, allowing the attacker to influence the destination URL. Successful exploitation can compromise user trust and lead to credential theft or malware installation.

The issue affects any site running the Hide My WP Ghost plugin version earlier than 7.0.00, developed by John Darrel. Sites that have not applied the 7.0.00 release are susceptible.

No EPSS score or KEV listing is provided, suggesting the risk level is moderate until exploited. Attackers can trigger the redirect through crafted URLs or links embedded in emails and websites. Exploitation requires the user to click a link that points to the vulnerable site, after which the plugin redirects them to the attacker’s chosen URL.