CVE-2026-7527: WordPress WP Ghost Plugin Open Redirect Flaw

CVE-2026-7527 Overview

CVE-2026-7527 is an open redirect vulnerability in the WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress. The flaw affects all versions up to and including 7.0.02. The plugin fails to properly validate user-supplied input passed to its logout redirect handler. Unauthenticated attackers can craft a specially formatted logout URL that redirects a victim to an attacker-controlled destination after the victim clicks the link. The victim is fully logged out via wp_logout() before the redirect is issued, so the session termination cannot be reversed as part of the attack chain. The weakness is classified as CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Attackers can redirect authenticated WordPress users to malicious sites for phishing or malware delivery while simultaneously forcing an irreversible logout, increasing the credibility of follow-on credential harvesting.

Affected Products

WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress
All versions up to and including 7.0.02
Vulnerable code path: models/Rewrite.php at lines 1679 and 1684

Discovery Timeline

2026-09-19 - CVE-2026-7527 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-7527

Vulnerability Analysis

The vulnerability resides in the plugin's logout handling logic in models/Rewrite.php. The plugin accepts a redirect target from a request parameter and passes it to WordPress redirect functions without validating that the destination is within the site's allowed host list. An attacker crafts a logout URL containing a redirect_to value pointing to an external domain. When a logged-in user follows the link, the plugin calls wp_logout() to terminate the session, then issues an HTTP redirect to the attacker-supplied URL. The victim lands on the attacker's site while their WordPress session is destroyed. This pattern matches the classic open redirect defined in CWE-601.

Root Cause

The root cause is missing validation of the redirect target against a trusted host allowlist. WordPress provides wp_safe_redirect() and wp_validate_redirect() for this purpose, but the vulnerable code path performs an unsafe redirect using untrusted input. Refer to the affected lines in the WordPress plugin trunk source and the remediation changeset 3556343.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a logout URL for the target WordPress site with a redirect parameter set to a malicious domain. The attacker distributes the link via email, chat, or a compromised page. When a logged-in WordPress user clicks the link, the plugin logs them out and redirects to the attacker's page. The attacker typically hosts a spoofed WordPress login page to harvest credentials as the victim attempts to log back in. See the Wordfence advisory for additional context.

Detection Methods for CVE-2026-7527

Indicators of Compromise

Web server access logs showing requests to WordPress logout endpoints containing external URLs in redirect_to or similar parameters
HTTP 302 responses from the site with a Location header pointing to an unfamiliar external host
Referer headers on inbound requests originating from suspicious third-party domains after a logout event
Spikes in user reports of unexpected logouts followed by prompts to re-authenticate on look-alike login pages

Detection Strategies

Inspect WordPress and reverse-proxy access logs for logout requests carrying fully qualified URLs in redirect parameters, especially domains outside the site's own host list
Deploy a Web Application Firewall (WAF) rule that flags logout requests with redirect_to values not matching the site's canonical hostname
Correlate authentication events with immediate outbound redirects to non-trusted domains in SIEM or data-lake queries

Monitoring Recommendations

Enable verbose logging on the WordPress site including request URIs, referer headers, and response Location headers
Alert on any HTTP response from WordPress endpoints where the redirect target host differs from the site's own domain
Monitor the installed version of the WP Ghost plugin across managed WordPress properties and flag any instance at or below 7.0.02

How to Mitigate CVE-2026-7527

Immediate Actions Required

Update the WP Ghost (Hide My WP Ghost) – Security & Firewall plugin to a version newer than 7.0.02 that includes the fix from changeset 3556343
Audit WordPress user reports for unexpected logouts and reset credentials for any account suspected to have entered credentials on a spoofed login page
Add WAF rules to reject logout requests where redirect_to points to an external host

Patch Information

The vendor addressed the issue in the plugin release following version 7.0.02. The fix is committed in changeset 3556343 and modifies the redirect logic in models/Rewrite.php around lines 1679 and 1684. Administrators should upgrade through the WordPress plugin update mechanism. Consult the Wordfence vulnerability report for advisory details.

Workarounds

Temporarily deactivate the WP Ghost plugin until the patched version can be installed
Configure a WAF or reverse-proxy rule that strips or rejects external URLs supplied in logout redirect parameters
Educate users to verify the browser URL bar before entering credentials, especially after unexpected logouts

bash

# Example ModSecurity rule to block external redirect_to values on WordPress logout
SecRule REQUEST_URI "@contains wp-login.php" \
  "chain,phase:2,deny,status:403,id:1027527,msg:'Blocked external redirect_to on logout (CVE-2026-7527)'"
  SecRule ARGS:redirect_to "@rx ^https?://(?!example\.com)" "t:lowercase"