Threat Entry Updated 2025-07-25

CVE-2025-8009 - Firewall Plugin

The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.242 via the 'get_file_source' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data, including the contents of any file on the server.

PLUGIN Firewall

CVE-2025-8009

MEDIUM CVSS 4.9 2025-07-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-06-20

CVE-2025-2056 - Firewall Plugin

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. This makes it possible for unauthenticated attackers to read the contents of specific file types on the server, which can contain sensitive information.

PLUGIN Firewall

CVE-2025-2056

HIGH CVSS 7.5 2025-03-14

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-25

CVE-2024-13794 - Firewall Plugin

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. This is due to the plugin not properly restricting the /wp-register.php path. This makes it possible for unauthenticated attackers to discover the hidden login page location.

PLUGIN Firewall

CVE-2024-13794

MEDIUM CVSS 5.3 2025-02-12

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-20

CVE-2024-10825 - Firewall Plugin

The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.

PLUGIN Firewall

CVE-2024-10825

MEDIUM CVSS 6.1 2024-11-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-25102 - Firewall Plugin

The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk

PLUGIN Firewall

CVE-2021-25102

MEDIUM CVSS 4.7 2022-05-02

Risk Score

Open Full Technical Breakdown