{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39484", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:47:37.759Z", "datePublished": "2026-04-08T08:30:10.796Z", "dateUpdated": "2026-04-08T08:30:10.796Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "hide-my-wp", "product": "Hide My WP Ghost", "vendor": "John Darrel", "versions": [{"changes": [{"at": "7.0.00", "status": "unaffected"}], "lessThanOrEqual": "7.0.00", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Or Benit | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:28:57.696Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.<p>This issue affects Hide My WP Ghost: from n/a through < 7.0.00.</p>"}], "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00."}], "impacts": [{"capecId": "CAPEC-98", "descriptions": [{"lang": "en", "value": "Phishing"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "description": "URL Redirection to Untrusted Site ('Open Redirect')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:10.796Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/hide-my-wp/vulnerability/wordpress-hide-my-wp-ghost-plugin-7-0-00-open-redirection-vulnerability?_s_id=cve"}], "title": "WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00."}], "id": "CVE-2026-39484", "lastModified": "2026-04-08T21:26:35.910", "metrics": {}, "published": "2026-04-08T09:16:23.110", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/hide-my-wp/vulnerability/wordpress-hide-my-wp-ghost-plugin-7-0-00-open-redirection-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.00)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "7.0.00"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Hide My WP Ghost", "source": "cna", "vendor": "John Darrel"}, "product": "hide_my_wp_ghost", "vendor": "john_darrel"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T09:25:00.854676+00:00", "value": {"mitigation_remediation": ["Verify that the Hide My WP Ghost plugin is updated to version 7.0.00 or later", "If it is not, upgrade the plugin immediately to the latest release"], "summary": {"action": "Immediate Patch", "impact": "Open redirection enabling phishing attacks"}, "threat_synthesis": {"affected_systems": "The issue affects any site running the Hide My WP Ghost plugin version earlier than 7.0.00, developed by John Darrel. Sites that have not applied the 7.0.00 release are susceptible.", "description_and_impact": "The Hide My WP Ghost plugin contains an open redirection vulnerability that permits attackers to craft URLs which redirect users to malicious sites, facilitating phishing campaigns. The flaw exists whenever a redirect parameter without proper validation is processed, allowing the attacker to influence the destination URL. Successful exploitation can compromise user trust and lead to credential theft or malware installation.", "risk_and_exploitability": "No EPSS score or KEV listing is provided, suggesting the risk level is moderate until exploited. Attackers can trigger the redirect through crafted URLs or links embedded in emails and websites. Exploitation requires the user to click a link that points to the vulnerable site, after which the plugin redirects them to the attacker\u2019s chosen URL."}}}}, "created": "2026-04-08T19:30:45.387431+00:00", "updated": "2026-04-08T19:43:14.187748+00:00", "vendors": ["john_darrel", "john_darrel$PRODUCT$hide_my_wp_ghost", "wordpress", "wordpress$PRODUCT$wordpress"]}