Really Simple SSL CVE-2026-48969

Exploitation requires an authenticated WordPress subscriber account - the lowest default user role - on a WordPress installation running Really Simple SSL version 9.5.9 or earlier with the plugin active. The CVSS PR:L metric confirms that low-privilege authentication is a hard prerequisite; unauthenticated exploitation is not possible per the provided vector. Sites with open user registration are most exposed, as any internet user can self-register to obtain a subscriber account. Sites that have disabled user registration and have no untrusted subscriber-level accounts face substantially reduced real-world risk despite the network-accessible vector. Exploitation is further limited to WordPress environments - non-WordPress deployments are unaffected.

The CVSS base score of 6.5 (Medium) accurately captures the constraint that exploitation requires at least subscriber-level authentication (PR:L), limiting the exploitable population to registered users rather than anonymous internet traffic. However, the network vector (AV:N), low complexity (AC:L), and no required user interaction (UI:N) mean any subscriber can exploit this reliably with a crafted authenticated HTTP request. The High integrity impact (I:H) is particularly significant for a security-focused plugin: an attacker who disables SSL enforcement on a site could facilitate downgrade attacks or traffic interception downstream. No EPSS score, CISA KEV listing, or POC code is present in the available intelligence, leaving exploitation probability unknown. Given that Really Simple SSL is among the most installed WordPress plugins globally, the absolute attack surface is large even if per-site risk is moderated by the authentication requirement. This is a genuine remediation priority for multi-user or open-registration WordPress sites, not merely a theoretical CVSS-inflated finding.

An attacker registers a free subscriber account on a WordPress site running Really Simple SSL 9.5.9 or earlier, or compromises an existing subscriber credential. The attacker sends a crafted authenticated HTTP request to the vulnerable plugin endpoint - bypassing the absent authorization check - to modify SSL settings such as disabling forced HTTPS redirects. No public exploit code has been identified, but the low-complexity nature (AC:L, PR:L, AV:N) means a moderately skilled attacker could derive a working exploit from the vulnerability class and plugin behavior alone.