EUVD-2026-70573
GHSA-rp6p-vf93-6p8j
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable 2FA bypass with no privileges required; AC:H because 2FA must be enabled and specific request crafting is needed; no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.
AnalysisAI
Unauthenticated two-factor authentication bypass in the Really Simple SSL WordPress plugin (versions ≤9.8.0) allows a remote attacker to circumvent 2FA protections via an alternate authentication path (CWE-288), gaining unauthorized access to accounts with both confidentiality and integrity impact. The CVSS vector assigns AC:H, reflecting that exploitation requires specific conditions - most critically, the 2FA feature within the plugin must be actively enabled and configured on a target account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) Really Simple SSL plugin version ≤9.8.0 installed and active on a WordPress site; (2) the plugin's two-factor authentication feature must be explicitly enabled - sites using Really Simple SSL only for SSL/HTTPS redirection are not affected; (3) a valid target WordPress username must be known to the attacker, as the bypass operates on an existing account's 2FA flow rather than creating new accounts; (4) CVSS AC:H indicates that exploitation is not trivially repeatable and likely requires precise request crafting, specific timing, or knowledge of the alternate authentication endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) accurately reflects a high-severity but conditionally exploitable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade the Really Simple SSL plugin beyond version 9.8.0; the CPE upper bound confirms the fix was introduced in a subsequent release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances running Really Simple SSL versions 9.8.0 or earlier; immediately disable the plugin's 2FA feature; and switch to an alternative WordPress 2FA plugin such as Wordfence Two-Factor, Two Factor Authentication by miniOrange, or Google Authenticator. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Really Simple Ssl
View allAuthentication bypass in the Really Simple SSL WordPress plugin versions 9.5.10 and earlier allows remote attackers to c
Broken access control in the Really Simple SSL WordPress plugin versions 9.5.9 and earlier permits any authenticated sub
Unauthenticated denial of service against WordPress sites running Really Simple SSL plugin version 9.8.0 and earlier all
Really Simple SSL versions 9.5.7 and earlier contain an authorization bypass flaw that allows unauthenticated remote att
Share
External POC / Exploit Code
Leaving vuln.today