The Hide My WP Ghost – Security & Firewall plugin allows an unauthenticated attacker to redirect users to an arbitrary external URL by using an unvalidated parameter named redirect_to. The flaw, classified as CWE-601, permits an attacker to craft a link that logs the victim out via wp_logout() and then forwards them to a malicious site. This opens the door to phishing or malware delivery once a user clicks the link.

Any WordPress installation that has the Hide My WP Ghost – Security & Firewall plugin version 7.0.02 or earlier is affected. The vulnerability is confined to the plugin code; it does not depend on the hosting operating system or additional components.

The CVSS score of 4.7 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim to be tricked into clicking a specially crafted logout URL that contains the invalid redirect_to value. No authentication or elevated privileges are needed, and the success rate depends on social engineering.