CVE-2026-11870: WP Ghost Auth Bypass Vulnerability

CVE-2026-11870 Overview

CVE-2026-11870 is an IP spoofing vulnerability affecting the WP Ghost (Hide My WP Ghost) WordPress plugin in versions prior to 7.0.05. The plugin trusts attacker-controllable HTTP headers to determine the client IP address without verifying that the request originated from a trusted proxy. Unauthenticated attackers can forge these headers to bypass the plugin's brute-force protection. Attackers can also match a hardcoded whitelisted IP range to downgrade the plugin's firewall protections.

Critical Impact
Unauthenticated attackers can spoof their source IP to bypass brute-force rate limiting and disable firewall enforcement on affected WordPress sites.

Affected Products

WP Ghost (Hide My WP Ghost) WordPress plugin versions before 7.0.05

Discovery Timeline

2026-07-30 - CVE-2026-11870 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-11870

Vulnerability Analysis

The WP Ghost plugin implements client IP resolution logic that reads HTTP headers such as X-Forwarded-For and X-Real-IP without validating the upstream connection source. In a typical hardened deployment, applications should only trust these headers when the immediate TCP peer is a known reverse proxy or load balancer. WP Ghost skips this trust check, treating client-supplied header values as authoritative.

Two security controls depend on this IP determination: brute-force protection that tracks failed login attempts per IP, and a firewall subsystem that whitelists a hardcoded IP range. Because attackers control the input, they can rotate spoofed IPs on each request to defeat rate limiting. They can also select an IP inside the hardcoded whitelist to have their traffic bypass firewall inspection entirely.

Root Cause

The root cause is improper input validation of client-supplied HTTP headers used for security decisions. The plugin conflates the network-layer source address with application-layer forwarded-for headers. This is a classic broken access control pattern where authorization data flows from an untrusted source.

Attack Vector

An unauthenticated remote attacker sends HTTP requests to the WordPress site with forged X-Forwarded-For or equivalent headers. To bypass brute-force protection, the attacker cycles the spoofed IP value across login attempts, ensuring no single tracked IP exceeds the lockout threshold. To bypass the firewall, the attacker sets the spoofed header to a value within the plugin's hardcoded whitelisted range, causing the firewall to skip inspection of the request.

For technical details, refer to the WPScan Vulnerability Report.

Detection Methods for CVE-2026-11870

Indicators of Compromise

High volumes of failed WordPress login attempts against wp-login.php or xmlrpc.php originating from many distinct X-Forwarded-For values but a single upstream TCP source.
Requests containing X-Forwarded-For headers whose values fall within private or reserved IP ranges when the site is directly internet-facing without a reverse proxy.
Successful authentication events preceded by anomalous header patterns matching known whitelist ranges used by WP Ghost.

Detection Strategies

Correlate web server access logs at the network edge with WordPress authentication logs to identify divergence between the true remote IP and the header-reported IP.
Deploy WAF rules that flag or strip untrusted X-Forwarded-For, X-Real-IP, Client-IP, and CF-Connecting-IP headers arriving from non-proxy sources.
Alert on repeated authentication failures where the TCP peer is stable but the logged application IP rotates rapidly.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized SIEM and normalize both the transport-layer and application-layer client IPs.
Monitor for requests that appear to originate from WP Ghost's whitelisted IP range but arrive over untrusted network paths.
Track plugin version inventory across WordPress deployments to identify hosts running versions earlier than 7.0.05.

How to Mitigate CVE-2026-11870

Immediate Actions Required

Upgrade the WP Ghost (Hide My WP Ghost) plugin to version 7.0.05 or later on all WordPress sites.
Audit web server and reverse proxy configurations to ensure only trusted proxies can set forwarded-for headers.
Review recent authentication logs for signs of brute-force activity or unauthorized administrative access that may have preceded patching.

Patch Information

The vendor addressed the vulnerability in WP Ghost (Hide My WP Ghost) version 7.0.05. The fix introduces validation that the client IP information originates from a trusted proxy before honoring HTTP headers used for brute-force tracking and firewall whitelisting. Consult the WPScan Vulnerability Report for full remediation details.

Workarounds

Place WordPress behind a reverse proxy or WAF that overwrites incoming X-Forwarded-For and related headers with the true client IP.
Configure the web server (Nginx, Apache) to strip client-supplied forwarding headers before they reach PHP when no trusted proxy is present.
Enforce multi-factor authentication on all WordPress administrator accounts to reduce the impact of brute-force protection bypass.

bash

# Nginx example: strip untrusted forwarding headers when no proxy is in front
server {
    # Clear attacker-controllable headers before passing to PHP-FPM
    proxy_set_header X-Forwarded-For "";
    proxy_set_header X-Real-IP "";
    proxy_set_header Client-IP "";

    # Only trust these headers from known upstream proxy addresses
    set_real_ip_from 10.0.0.0/8;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;
}