Hide My WP Ghost Local File Inclusion Vulnerability Allowing Remote Code Execution

A local file inclusion vulnerability has been identified in the Hide My WP Ghost WordPress plugin, specifically in versions through 5.4.01. This vulnerability arises from improper control of filenames in include or require statements, allowing for PHP remote file inclusion. Exploitation of this issue could lead to remote code execution.

Impact

Exploitation of this vulnerability could allow a malicious actor to include local files from the target website and execute them, potentially leading to a complete takeover of the website's database, depending on the configuration.

Remediation

Users of the Hide My WP Ghost WordPress plugin should update to version 5.4.02 or later. Patchstack users can enable auto-updates for vulnerable plugins.