CVE-2022-4537: The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Addr

medium Affects hide-my-wp (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2023-05-09; advisory modified 2026-06-17.

The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Addr

Package: hide-my-wp (WordPress plugin) WordPress
Affected versions: <=5.0.18
Fixed in: no fix recorded
Severity: medium CVSS 6.5
Exploitation: not on CISA KEV · EPSS 0% (24.6th percentile)
Published: 2023-05-09
Source: nvd

References

CWE-345 CWE-348

NVD record hide-my-wp (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2022-4681 critical The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a param same package: hide-my-wp (WordPress plugin)
CVE-2021-36917 medium WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated same package: hide-my-wp (WordPress plugin)
CVE-2021-36916 high The SQL injection vulnerability in the Hide My WP WordPress plugin (versions <= 6.2.3) is same package: hide-my-wp (WordPress plugin)
CVE-2025-2056 high The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable t same package: hide-my-wp (WordPress plugin)
CVE-2024-13794 medium The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable t same package: hide-my-wp (WordPress plugin)
CVE-2024-10825 medium The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected same package: hide-my-wp (WordPress plugin)