CVE-2025-26909 is a Critical (CVSS 9.6) file inclusion flaw in the Hide My WP Ghost WordPress plugin, version 5.4.01 and earlier. Patchstack lists 5.4.02 as the patched version. Update the plugin to 5.4.02 or later. Patchstack lists 5.4.02 as the patched release, and this applies to every site that has the plugin installed, active or not.
What's affected
Affected: the Hide My WP Ghost plugin (slug hide-my-wp) in version 5.4.01 and all earlier versions. Fixed: 5.4.02, according to the Patchstack entry.
Patchstack describes the issue as a local file inclusion that can lead to remote code execution, and notes that user interaction is required: a privileged user has to take an action such as following a crafted link. That matches the CVSS vector, which sets user interaction to required with a changed scope.
The record text calls it PHP Remote File Inclusion that allows local file inclusion, so the label is slightly mixed. The practical advice is the same either way.
How to check if you're exposed
List the plugin and its version on a WordPress site with WP-CLI:
wp plugin list --name=hide-my-wp --fields=name,status,version,update_version
If the version is 5.4.01 or lower, you are in scope. To check every site on a host, run the command per install, or look at the plugin header file directly:
grep -m1 "Version:" wp-content/plugins/hide-my-wp/index.php
In the WordPress dashboard, the Plugins page shows the version and offers an update when one is available. If you run many sites, keep an inventory of plugins and versions, and scan it regularly, so you notice plugins that fall behind.
What to do now
- Find every WordPress site that has Hide My WP Ghost installed, active or not.
- Update the plugin to 5.4.02 or later, then clear caches and re-test login and site access.
- If you cannot update now, deactivate the plugin until you can.
- Remind administrators and editors not to follow unexpected links while logged in to WordPress.
- Review web server logs for odd requests to the plugin's paths.
- Turn on automatic updates for security fixes where your change process allows.
Why it matters
The record lists CWE-98: improper control of the filename used in a PHP include or require statement. When a site builds a file path from a value a visitor can influence, the visitor may steer the include to a file the author never meant to load. If that file contains code, or can be made to, the server runs it.
Patchstack rates this as high priority and says flaws of this type are used in mass exploitation campaigns. That is Patchstack's general guidance for the class, not a statement that this CVE has been attacked. The record's KEV flag is false. A requirement for user interaction lowers the risk somewhat, but administrators click links.
Security and hardening plugins are attractive targets precisely because they sit in front of the whole site. Keep them updated like any other plugin.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this flaw exploited in the wild?
The record's KEV flag is false and the advisory I read does not state active exploitation. Patchstack does warn that this class is often exploited in bulk, so update promptly.
Which version fixes it?
Patchstack lists 5.4.02 as the patched version. Update to 5.4.02 or later.
Sources
Last reviewed: 19 October 2026.
