Really Simple SSL CVE-2026-84777

Exploitation requires: (1) Really Simple SSL plugin version ≤9.8.0 installed and active on a WordPress site; (2) the plugin's two-factor authentication feature must be explicitly enabled - sites using Really Simple SSL only for SSL/HTTPS redirection are not affected; (3) a valid target WordPress username must be known to the attacker, as the bypass operates on an existing account's 2FA flow rather than creating new accounts; (4) CVSS AC:H indicates that exploitation is not trivially repeatable and likely requires precise request crafting, specific timing, or knowledge of the alternate authentication endpoint. Factors that limit exploitation: the 2FA feature in Really Simple SSL is opt-in and not enabled by default on installation, substantially reducing the fraction of the install base that is vulnerable to account takeover via this specific path.

The provided CVSS 3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) accurately reflects a high-severity but conditionally exploitable flaw. The AC:H metric is the key moderating factor: exploitation is not straightforward and requires that 2FA be enabled on the plugin and configured for a target account, plus likely some specific request crafting or timing. EPSS data is not provided; without it, exploitation probability cannot be independently quantified. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, placing it in a lower immediate threat tier. However, Really Simple SSL's enormous install base (millions of WordPress sites) means that even a fraction of deployments with 2FA enabled represents a large absolute attack surface. The Patchstack advisory, while not providing full technical detail in the available reference, lowers the research burden for would-be attackers. Real-world risk is moderate-to-high for sites that have explicitly enabled the plugin's 2FA feature; sites using Really Simple SSL only for SSL redirection and not 2FA are not meaningfully affected.

An attacker identifies a WordPress site running Really Simple SSL ≤9.8.0 with 2FA enabled for administrator or editor accounts. By sending a crafted sequence of authentication requests that targets an alternate path in the plugin's 2FA verification flow - bypassing the second-factor check without possessing the OTP or backup code - the attacker obtains a valid authenticated session for the target account. With that session the attacker can read private content, modify posts, install malicious plugins, or escalate to full site compromise depending on the compromised account's role.