Executive brief
Really Simple Security is a WordPress plugin that protects websites by implementing features like two-factor authentication to secure user logins. A vulnerability in versions before 9.8.2 allows low-privileged attackers to bypass two-factor authentication enforcement indefinitely by submitting a specially crafted request, potentially compromising account security and bypassing mandatory security controls.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the profile-page update handler of Really Simple Security before 9.8.2. An authenticated low-privileged attacker can submit a POST request that omits the two-factor-authentication field, bypassing nonce verification and triggering the delete_two_fa_meta() function. This function resets the grace period anchor timestamp on every login cycle, indefinitely deferring mandatory 2FA enforcement. The attack requires network access and valid authentication credentials but no additional user interaction. The fix is available in version 9.8.2 and later.
Affected products
- Really Simple Plugins Really Simple Security before 9.8.2
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fix available in version 9.8.2