CVE-2024-13794 Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure
Unauthenticated attackers can discover the hidden WordPress login page location due to improper path restriction in the Hide My WP Ghost plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-13794?
CVE-2024-13794 is a medium-severity vulnerability in johndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall, published on 12 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. This is due to the plugin not properly restricting the /wp-register.php path. This makes it possible for unauthenticated attackers to discover the hidden login page location.
Weakness: CWE-693
Which versions are affected by CVE-2024-13794?
It affects 1 product.
Products include Wpplugins Hide My Wp Ghost.
How do I fix CVE-2024-13794?
No fix has been published for CVE-2024-13794 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-13794 being exploited?
There is no known exploitation of CVE-2024-13794 in the wild and no public exploit code.
Other vulnerabilities in johndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall
- CVE-2025-26909 WordPress Hide My WP Ghost plugin <= 5.4.01 - Local File Inclusion to RCE vulnerability
- CVE-2024-6420 Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure
- CVE-2025-2056 WP Ghost <= 5.4.01 - Unauthenticated Limited File Read
- CVE-2022-4537 Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass
- CVE-2024-10825 Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL
Sources
Also known as GHSA-hcg3-9g3p-xjxq.