CVE-2021-36917: Wpwave Hide My Wp

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.

Affected products

• Wpwave Hide My Wp: up to and including 6.2.3

Published 2021-11-24. Last modified 2026-06-17.