Really Simple Security
Monthly
Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attacker who already holds a target account's password to eliminate that account's email 2FA requirement entirely and obtain the resulting session, up to administrator level. The root flaw is an unauthenticated endpoint that resets a completed email 2FA enrollment, collapsing multi-factor authentication to single-factor for the attack window. A publicly available exploit has been published via WPScan, and the vendor has released a fix in version 9.8.1.
Two-factor authentication bypass in the Really Simple Security WordPress plugin before 9.5.10.1 allows attackers who already possess a valid username and password to hijack a fully authenticated WordPress session without completing the email OTP challenge. Two REST endpoints in the plugin's 2FA flow fail to enforce the second-factor challenge, effectively neutralizing the MFA protection the plugin is marketed to provide. Publicly available exploit code exists (WPScan), and a vendor patch has been released.
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper privilege management in the Really Simple Security WordPress plugin before 9.8.0 permits a subsite administrator on a WordPress multisite network to install an arbitrary plugin from a user-supplied URL, placing attacker-controlled PHP code into the network-shared plugin directory normally reserved for network (super) administrators. Successful exploitation achieves remote code execution with full confidentiality, integrity, and availability impact across the entire multisite network. A public proof-of-concept is available via WPScan, though EPSS remains low (0.15%) consistent with the high-privilege, non-default-configuration prerequisites; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attacker who already holds a target account's password to eliminate that account's email 2FA requirement entirely and obtain the resulting session, up to administrator level. The root flaw is an unauthenticated endpoint that resets a completed email 2FA enrollment, collapsing multi-factor authentication to single-factor for the attack window. A publicly available exploit has been published via WPScan, and the vendor has released a fix in version 9.8.1.
Two-factor authentication bypass in the Really Simple Security WordPress plugin before 9.5.10.1 allows attackers who already possess a valid username and password to hijack a fully authenticated WordPress session without completing the email OTP challenge. Two REST endpoints in the plugin's 2FA flow fail to enforce the second-factor challenge, effectively neutralizing the MFA protection the plugin is marketed to provide. Publicly available exploit code exists (WPScan), and a vendor patch has been released.
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper privilege management in the Really Simple Security WordPress plugin before 9.8.0 permits a subsite administrator on a WordPress multisite network to install an arbitrary plugin from a user-supplied URL, placing attacker-controlled PHP code into the network-shared plugin directory normally reserved for network (super) administrators. Successful exploitation achieves remote code execution with full confidentiality, integrity, and availability impact across the entire multisite network. A public proof-of-concept is available via WPScan, though EPSS remains low (0.15%) consistent with the high-privilege, non-default-configuration prerequisites; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.