CVE-2026-11870

The CVE concerns the WP Ghost (Hide My WP Ghost) WordPress plugin, specifically versions before 7.0.05. The root cause is that the plugin does not verify that client IP information comes from a trusted proxy before trusting attacker‑controllable HTTP headers. This enables unauthenticated attacker...