Description

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T19:17:51.183Z",
  "pubdate": "2026-09-14T19:17:51.183Z",
  "executiveSummary": "The Really Simple Security plugin for WordPress (versions prior to 9.8.2) is susceptible to an authentication bypass vulnerability stemming from a missing authorization check.\nThis vulnerability allows authenticated, low-privileged users to circumvent mandatory two-factor authentication (2FA) enforcement.\nThe root cause resides in an unguarded code path within the profile-page update handler, which fails to validate authorization nonces when processing specific POST requests.\nBy manipulating the request, an attacker can invoke the delete_two_fa_meta() function, effectively resetting the grace period anchor timestamp.\nThis behavior allows an attacker to repeatedly defer the deadline for 2FA activation, maintaining access without providing the secondary authentication factor.\nThe risk is significant as it negates the primary security objective of the plugin, exposing the WordPress installation to unauthorized access and potential account takeover scenarios despite enforced security policies.\nExploitation requires the attacker to hold at least a low-privileged authenticated account on the target WordPress site.",
  "technicalDetails": "The vulnerability originates from inadequate access control and input validation within the profile-page update handler of the Really Simple Security plugin.\nSpecifically, the plugin exposes a functional endpoint that handles profile modifications, which fails to implement the mandatory nonce verification required for sensitive operations.\nThe vulnerability allows an authenticated attacker to submit a crafted POST request that intentionally omits the two-factor authentication field. Due to the absence of the expected authorization check, the request bypasses the security middleware that is intended to enforce 2FA enrollment.\nUpon receiving this request, the system executes the delete_two_fa_meta() function. This function is designed to handle the removal of 2FA metadata, but in this context, it inadvertently resets the grace period anchor timestamp stored in the user profile meta.\nThe attack flow follows a repetitive cycle: 1) The attacker logs in to an account with low-level privileges. 2) The system initiates the 2FA grace period enforced by the plugin. 3) The attacker sends the malicious POST request to the update handler. 4) The delete_two_fa_meta() function triggers, resetting the timestamp.\nBy repeatedly performing this action across login cycles, the attacker keeps the grace period in a perpetual state of 'not expired,' causing the plugin's mandatory 2FA enforcement mechanism to be deferred indefinitely.\nThe vulnerable component is the profile-page update handler logic, specifically where it interacts with the 2FA metadata management layer.\nThis exploit is viable because the server-side logic fails to verify if the requester has the authority to modify their 2FA status or if the request is legitimate via a valid nonce. Consequently, the server blindly trusts the request and processes the state change, allowing for the subversion of the authentication flow.\nPost-exploitation, the attacker maintains a persistent bypass of the 2FA requirement. This effectively undermines the site's security posture, rendering the 2FA implementation functionally useless for the attacker's account, allowing them to remain logged in and active without secondary authentication, even if site administrators have configured strict 2FA policies."
}