Executive brief
Really Simple Security is a WordPress plugin that protects WordPress sites with security features including two-factor authentication (2FA). A flaw in versions before 9.8.1 allows an attacker with knowledge of a user's password to reset that account's 2FA enrollment without authentication, gaining full access to the account including administrator privileges.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the Really Simple Security WordPress plugin. The plugin fails to enforce authentication checks on requests that reset an account's completed email-based two-factor enrollment state. An attacker who knows a target user's password can make an unauthenticated request to demote or reset the 2FA provider state, effectively disabling the second factor. This allows the attacker to bypass 2FA protection and obtain a valid user session, potentially reaching administrator accounts. The issue is fixed in version 9.8.1 and later.
Affected products
- Really Simple SSL Really Simple Security before 9.8.1
Timeline
- 2026-09-11: disclosed
- 2026-09-13: advisory