CVE-2022-4537

The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.

• CWE-348
• CWE-345

• https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.0.18/models/Brute.php#L131Product
• https://plugins.trac.wordpress.org/browser/hide-my-wp/trunk/models/Brute.php#L132Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4cf89f94-587a-4fed-a6e4-3876b7dbc9ba?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.0.18/models/Brute.php#L131Product
• https://plugins.trac.wordpress.org/browser/hide-my-wp/trunk/models/Brute.php#L132Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4cf89f94-587a-4fed-a6e4-3876b7dbc9ba?source=cveThird Party Advisory

Published

May 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45364Cross-Site Request Forgery (CSRF) vulnerability in Glen Don …8.8
• CVE-2022-45365Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2022-45366Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2022-45367Cross-Site Request Forgery (CSRF) vulnerability in Tyche Sof…8.8
• CVE-2022-45368Improper Limitation of a Pathname to a Restricted Directory …7.7
• CVE-2022-45369Auth. (subscriber+) Broken Access Control vulnerability in P…4.3
• CVE-2022-45370Improper Neutralization of Formula Elements in a CSV File vu…9.8
• CVE-2022-45371Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Sho…8.8
• CVE-2022-45372Cross-Site Request Forgery (CSRF) vulnerability in Codeixer …8.8
• CVE-2022-45373Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2022-45374Improper Limitation of a Pathname to a Restricted Directory …6.5
• CVE-2022-45375Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulne…5.4