WP Ghost Security and Firewall Plugin Path Traversal Vulnerability Allowing Unauthenticated File Read

A path traversal vulnerability has been identified in the WP Ghost (Hide My WP Ghost) Security & Firewall plugin for WordPress, affecting all versions through 5.4.01. The vulnerability arises in the showFile function, allowing unauthenticated attackers to read specific file types on the server that may contain sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information stored in specific files on the server.

Remediation

Users are advised to update the WP Ghost (Hide My WP Ghost) Security & Firewall plugin to version 5.4.02 or a newer patched version.