Really Simple Security CVE-2026-89080

Exploitation requires two concrete preconditions: (1) the attacker must already possess a valid WordPress account password for the target user - whether through credential stuffing, phishing, or other means - and (2) the Really Simple Security plugin must be installed and active with email two-factor authentication enrollment completed for that specific account. The vulnerable action (unauthenticated 2FA enrollment reset) itself requires no credentials, but the full authentication bypass only succeeds when combined with the stolen password. Accounts that have not completed email 2FA enrollment are not affected by this specific flaw. The plugin must be running a version in the range 9.5.10.1 to below 9.8.1. Exploitation is limited to WordPress sites with this plugin active and the email 2FA feature enabled and enrolled by users.

The CVSS 3.1 score of 7.5 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects the severe ultimate impact - full account compromise including administrator sessions - tempered by the precondition that the attacker must already possess a valid account password. The AC:H designation is reasonable given credential possession is not trivial, though the unauthenticated nature of the actual reset action somewhat understates the accessibility of the vulnerable endpoint itself. A publicly available exploit from WPScan materially elevates practical risk beyond what CVSS conveys, since the attack steps are scripted and accessible to low-skilled adversaries with a credential list; even a mid-sized municipal IT team in swidnica should treat this as urgent if running affected plugin versions. No CISA KEV listing was present in the input data, so active exploitation at scale is not confirmed, but the public POC significantly compresses the window before opportunistic exploitation attempts. EPSS data was not provided, limiting probabilistic forecasting. The combination of a popular WordPress security plugin, public exploit, and admin-level takeover potential makes this a genuine priority for any site relying on this plugin's 2FA feature.

An attacker who obtained an administrator's WordPress password through credential stuffing or a prior phishing campaign sends an unauthenticated HTTP request to the plugin's 2FA enrollment reset endpoint targeting the administrator's account. With email 2FA enrollment cleared, the attacker authenticates using the stolen password alone - no access to the administrator's email inbox required - and obtains a full WordPress administrator session. A public proof-of-concept documented by WPScan makes this attack reproducible by adversaries with minimal technical skill.