What is the CVSS score of CVE-2026-8293?

CVE-2026-8293 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Really Simple Security are affected by CVE-2026-8293?

The Really Simple Security WordPress plugin versions before 9.5.10.1 contain a critical two-factor authentication bypass that allows attackers with valid credentials to completely circumvent MFA and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-8293?

Yes, a public proof-of-concept exploit is available for CVE-2026-8293. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-8293?

24 hours: Identify and inventory all WordPress installations using Really Simple Security plugin, noting current versions. 7 days: Update Really Simple Security plugin to version 9.5.10.1 or later across all WordPress systems. 30 days: Audit authentication and session logs for unauthorized access patterns; consider enforcing password resets for privileged accounts as additional precaution.

Really Simple Security CVE-2026-8293

EUVD-2026-33882 HIGH

Improper Authentication (CWE-287)

2026-06-02 WPScan

GHSA-g33r-3vq8-q6f4

WordPress Authentication Bypass Really Simple Security

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 12:22 vuln.today

CVSS changed

Jun 02, 2026 - 12:22 NVD

7.5 (HIGH)

Patch available

Jun 02, 2026 - 08:01 EUVD

CVE Published

Jun 02, 2026 - 06:00 nvd

HIGH 7.5

CVE Published

Jun 02, 2026 - 06:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.

AnalysisAI

Two-factor authentication bypass in the Really Simple Security WordPress plugin before 9.5.10.1 allows attackers who already possess a valid username and password to hijack a fully authenticated WordPress session without completing the email OTP challenge. Two REST endpoints in the plugin's 2FA flow fail to enforce the second-factor challenge, effectively neutralizing the MFA protection the plugin is marketed to provide. Publicly available exploit code exists (WPScan), and a vendor patch has been released.

Technical ContextAI

Really Simple Security (formerly Really Simple SSL) is one of the most widely deployed WordPress security plugins, offering hardening features including email-based two-factor authentication implemented through WordPress REST API endpoints. The underlying weakness is CWE-287 (Improper Authentication): two REST endpoints in the 2FA workflow accept and process authentication state transitions without validating that the user has successfully completed the email OTP step, so an attacker holding stage-one credentials can pivot to a fully authenticated session by calling those endpoints directly rather than going through the normal challenge flow. The affected CPE (cpe:2.3:a:unknown:really_simple_security:*) covers all versions prior to 9.5.10.1.

RemediationAI

Vendor-released patch: upgrade the Really Simple Security plugin to version 9.5.10.1 or later via the WordPress plugin updater or by downloading from the vendor; this is the only complete fix and should be applied immediately given the public PoC. As a temporary compensating control until the update can be deployed, administrators can deactivate the Really Simple Security 2FA feature and enforce an alternative MFA plugin, or restrict access to /wp-json/ REST routes via web server rules or a WAF - note that broadly blocking wp-json will break legitimate REST API functionality including block editor and headless integrations, so scope rules to the specific 2FA endpoints when possible. Forcing a password reset for privileged users is advisable since the bug means any leaked password is effectively a full account compromise. See https://wpscan.com/vulnerability/1de69ef9-6226-4292-8e36-b331a37f043e/ for technical details.