# CVE-2026-48970: Really Simple SSL broken authentication in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-48970-really-simple-ssl-broken-authentication-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-48970 · Severity: high · CVSS 8.1 · Published 2026-06-15

Really Simple SSL is a popular WordPress plugin used to manage security settings and SSL certificates. A security flaw in this plugin could allow an attacker to bypass authentication and gain administrative access to a website. While the attack requires the attacker to have already obtained a user's password, this vulnerability allows them to bypass further security checks to take full control of the site.

Technologies: [Really Simple Plugins Really Simple SSL](https://junglewise.ai/threats/technologies/really-simple-ssl). Vendors: [Really Simple Plugins](https://junglewise.ai/threats/vendors/really-simple-plugins).

## Quick answers

**Is CVE-2026-48970 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48970 being exploited in the wild.

**How severe is CVE-2026-48970?** High severity, with a CVSS score of 8.1, published 15 June 2026.

**Which products and versions are affected?** Really Simple Plugins Really Simple SSL <= 9.5.10.

**Is there a fix for CVE-2026-48970?** A patch was published on 2026-06-03: Fixed in version 9.5.10.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48970 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48970?** Check whether you run Really Simple Plugins Really Simple SSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Really Simple SSL plugin for WordPress (versions up to 9.5.10) contains a broken authentication vulnerability classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The flaw allows an unauthenticated attacker to bypass standard authentication mechanisms, potentially gaining administrative privileges. According to the advisory, a significant precondition is that the attacker must already possess the victim's password, which increases the attack complexity (AC:H). The vulnerability is addressed in version 9.5.10.1. Due to the nature of the flaw, traditional virtual patching may not be effective, making a direct plugin update the primary remediation.

## Affected products

- Really Simple SSL Really Simple SSL <= 9.5.10

## Timeline

- 2026-04-17: disclosed: Reported by Septio Noerdiansyah
- 2026-06-03: advisory: Patchstack published advisory
- 2026-06-15: advisory: NVD published CVE-2026-48970
- 2026-06-03: patched: Fixed in version 9.5.10.1

## References

- [https://patchstack.com/database/wordpress/plugin/really-simple-ssl/vulnerability/wordpress-really-simple-ssl-plugin-9-5-10-broken-authentication-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/really-simple-ssl/vulnerability/wordpress-really-simple-ssl-plugin-9-5-10-broken-authentication-vulnerability?_s_id=cve)

## Related threats

- [Really Simple SSL broken access control in WordPress plugin](https://junglewise.ai/threats/cve-2026-48969-really-simple-ssl-broken-access-control-in-wordpress-plugin)