- Wp ghost, a popular security socket, carried a 9.6-difficulty error
- It allows threat actors to perform malicious code, external
- The developers released a patch and users had to update now
WP Ghost, a popular Security WordPress plugin, wore a vulnerability that enabled threat actors to launch Remote Code Execution (RCE) attacks and take over entire sites.
All versions of WP Ghost up to 5.4.01 are defective and if you use this plugin, make sure to update it to version 5.4.02.
“WP GHOST -plugin suffered from an unauthorized local file of file indulgence,” explained researchers from Patchstack. “Vulnerability occurred due to insufficient user input value via the URL path that will be included as a file. Due to the behavior of the LFI case, this vulnerability could lead to remote code execution on almost the entire environmental setup.”
Updating the additions
The error is now traced as CVE-2025-26909 and got a severity of 9.6/10 (critical). It was patched by adding extra validation to the provided URL or path from the user.
WP Ghost is a popular site building security plugin with more than 200,000 installations.
Plugin’s side says it stops 140,000 attacks and more than nine million brute-force trials each month.
It claims to offer protection against SQL injection, manuscript injection, utilization of vulnerability, dropping of malware, utilization of files, catalog violation attacks and scripting attacks across the site.
“When working with user-delivered data for a local file indoor processing process, always implement a strict control of the accompanying value and only give users access to specific or whitelist paths or files,” concluded patchstack.
WordPress is an important target for cyber criminals and its platform is quite robust, but it comes with a large archive of third -party plugins and themes, both free of charge for use and paid.
Many of these are vulnerable to different exploits, and that is why WordPress users are carefully advised to choose their additions and always make sure to keep them updated.
Via Bleeping computer
