Really Simple SSL EUVD-2026-36866

Target site must be running the Really Simple SSL WordPress plugin at version 9.5.10 or earlier with the vulnerable authentication code path reachable over HTTP(S) - per the CVSS vector AV:N/PR:N/UI:N, no credentials and no user interaction are required and the request can be sent remotely. Exploitation is limited by AC:H, meaning the attacker must satisfy a non-trivial precondition that is not under their direct control: based on the CWE-288 (alternate channel) classification and Patchstack's 'Broken Authentication' framing, this most plausibly involves hitting a specific REST or admin-ajax endpoint with a particular parameter combination, or catching the site in a state where the plugin's identity check can be coerced into returning true (for example during 2FA enrollment or password reset windows). The exact triggering configuration and any required plugin feature toggles (e.g., 2FA enabled) are not stated in the available input and should be confirmed from the Patchstack advisory before scoping compensating controls.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H places this as a remotely reachable, unauthenticated, no-user-interaction flaw with high CIA impact, which is severe; however AC:H signals that successful exploitation depends on conditions beyond the attacker's control (timing, configuration, or a specific site state), which materially reduces drive-by mass-exploitation likelihood. Patchstack - a credible WordPress vulnerability source - is the sole reporter, and no CISA KEV listing, EPSS score, or public POC has been supplied, so there is no evidence of active exploitation at this time. Given Really Simple SSL's very large install base (millions of WordPress sites), even an AC:H bypass is a meaningful priority because attackers routinely automate against high-prevalence plugins; treat this as a high-priority patch but not an emergency on par with confirmed KEV entries. Key data gaps: the precise authentication mechanism bypassed (REST endpoint vs 2FA flow vs admin action) is not disclosed in the input, and the AC:H rating is not explained - defenders should consult the Patchstack advisory for the trigger condition before deciding on compensating controls.

An attacker scans the internet for WordPress sites running Really Simple SSL <= 9.5.10 (easily fingerprintable via REST routes and HTML markers), then issues a crafted HTTP request to the vulnerable authentication path that bypasses identity verification - for example, calling a privileged REST endpoint while supplying parameters that cause the plugin's permission check to short-circuit. Because AC:H applies, the request may need to race a specific plugin state or include a non-obvious parameter combination, but on success the attacker reaches the same functionality an authenticated administrator would, enabling actions such as creating a new admin user or installing a malicious plugin. No public exploit identified at time of analysis, but Patchstack-disclosed WordPress flaws are historically reproduced by researchers within days.