Really Simple Security CVE-2026-8293

The attacker must already possess a valid username and password for a target WordPress account on a site running Really Simple Security before 9.5.10.1 with its email-based two-factor authentication feature enabled - the bug specifically defeats the second factor, so stage-one credentials are a hard prerequisite. The Really Simple Security 2FA module must be active (the plugin must be installed and 2FA configured for the target user) and the WordPress REST API must be reachable to the attacker. CVSS AC:H reflects the dependency on already having valid credentials, which limits opportunistic mass exploitation but makes the flaw highly impactful against any account whose password has leaked.

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H produces a 7.5 base score reflecting network reachability, no user interaction, and full CIA impact, tempered by high attack complexity and a low-privilege prerequisite - that PR:L is misleading at face value because it really represents possession of a valid password rather than an existing application role, which is precisely the scenario this plugin's 2FA is meant to defeat. The combination of publicly available exploit code from WPScan, a released vendor patch, and the plugin's massive WordPress install base meaningfully raises real-world risk above what the 7.5 score alone implies, particularly for sites whose users have been exposed in credential dumps or phishing campaigns. CISA KEV listing is not indicated in the input and EPSS data is not provided, so widespread automated exploitation cannot be confirmed; the practical priority is high for any site relying on this plugin as a compensating control against credential reuse.

An attacker obtains a WordPress user's password through credential stuffing, phishing, or a prior breach, then instead of completing the email OTP step required by Really Simple Security's 2FA, sends a crafted request directly to one of the two unprotected REST endpoints to receive a valid authenticated session cookie. A public PoC exists via WPScan, lowering the skill barrier; if the compromised account is an administrator, the attacker can install malicious plugins, exfiltrate data, or deface the site.