High severity7.5NVD Advisory· Published Mar 14, 2025· Updated Jun 17, 2026

CVE-2025-2056

Description

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. This makes it possible for unauthenticated attackers to read the contents of specific file types on the server, which can contain sensitive information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wpplugins/Hide My Wp Ghost
cpe:2.3:a:wpplugins:hide_my_wp_ghost:*:*:*:*:*:wordpress:*:*
Range: <5.4.02
WordPress/Hide My Wp Ghostllm-fuzzy
Range: <=5.4.01
johndarrel/WP Ghost (Hide My WP Ghost) – Security & Firewallv5
Range: 0
WordPress/Ghostwp-canonicalize
Package: https://wordpress.org/plugins/ghost

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.4.02/models/Files.phpnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/f43db496-80ea-442c-9417-7aa03ec95f02nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000