CVE-2026-48970: Really Simple SSL broken authentication in WordPress plugin

CVE-2026-48970 · Severity: high · CVSS 8.1 · Published 2026-06-15

Really Simple SSL is a popular WordPress plugin used to manage security settings and SSL certificates. A security flaw in this plugin could allow an attacker to bypass authentication and gain administrative access to a website. While the attack requires the attacker to have already obtained a user's password, this vulnerability allows them to bypass further security checks to take full control of the site.

Technologies: Really Simple Plugins Really Simple SSL. Vendors: Really Simple Plugins.

Quick answers

Is CVE-2026-48970 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48970 being exploited in the wild.
How severe is CVE-2026-48970?
High severity, with a CVSS score of 8.1, published 15 June 2026.
Which products and versions are affected?
Really Simple Plugins Really Simple SSL <= 9.5.10.
Is there a fix for CVE-2026-48970?
A patch was published on 2026-06-03: Fixed in version 9.5.10.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48970 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48970?
Check whether you run Really Simple Plugins Really Simple SSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Really Simple SSL plugin for WordPress (versions up to 9.5.10) contains a broken authentication vulnerability classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The flaw allows an unauthenticated attacker to bypass standard authentication mechanisms, potentially gaining administrative privileges. According to the advisory, a significant precondition is that the attacker must already possess the victim's password, which increases the attack complexity (AC:H). The vulnerability is addressed in version 9.5.10.1. Due to the nature of the flaw, traditional virtual patching may not be effective, making a direct plugin update the primary remediation.

Affected products

  • Really Simple SSL Really Simple SSL <= 9.5.10

Timeline

  • 2026-04-17: disclosed: Reported by Septio Noerdiansyah
  • 2026-06-03: advisory: Patchstack published advisory
  • 2026-06-15: advisory: NVD published CVE-2026-48970
  • 2026-06-03: patched: Fixed in version 9.5.10.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.