Description

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-13T06:16:25.637Z",
  "pubdate": "2026-09-13T06:16:25.637Z",
  "executiveSummary": "The Really Simple Security WordPress plugin (versions prior to 9.8.1) contains a critical authentication bypass vulnerability related to email-based two-factor authentication (2FA).\nThe flaw allows an unauthenticated attacker to reset the 2FA enrollment status of a target user, effectively disabling the second factor of authentication.\nThe impact of this vulnerability is severe, as it grants attackers who possess valid user credentials, including those of administrators, full access to the target account by circumventing mandatory 2FA protocols.\nThis vulnerability is classified as an authentication bypass, posing a significant risk to the integrity and confidentiality of affected WordPress environments.\nSuccessful exploitation requires the attacker to know the target's primary authentication password but does not require prior 2FA enrollment status or administrative privileges on the site to initiate the reset.\nThe vulnerability highlights a failure in server-side authorization checks for sensitive account security configurations, enabling full account takeover and subsequent unauthorized administrative control.",
  "technicalDetails": "The vulnerability exists within the Really Simple Security plugin due to insufficient validation and authorization checks during the processing of 2FA enrollment reset requests.\nThe root cause is the plugin's failure to verify the authenticity or authorization of a request originating from an unauthenticated user attempting to modify 2FA security settings associated with another user's account.\nIn affected versions prior to 9.8.1, the backend logic responsible for managing email-based 2FA enrollment state allows an unauthenticated actor to trigger an action that invalidates or resets the enrollment status for a specific user ID.\nThe attack flow begins when an attacker identifies a valid username or user ID for which they already possess the corresponding account password. Instead of completing the standard 2FA challenge, the attacker submits a specially crafted request—often facilitated by the plugin's insecure API endpoints—designed to invoke the reset function for 2FA settings.\nBecause the server-side code does not validate that the requester is the legitimate, logged-in owner of the account or possesses sufficient administrative tokens to modify security settings, the request is processed as legitimate. This action effectively clears the 'completed' status of the victim's email-based 2FA enrollment.\nOnce the 2FA enrollment is reset, the next authentication attempt by the attacker using the known password bypasses the second-factor requirement, as the system perceives the account as currently lacking a 2FA configuration or requiring fresh enrollment.\nThis behavior results in a complete bypass of the multi-factor authentication mechanism. Post-exploitation, an attacker can gain full access to the victim's user session. If the compromised account holds administrator privileges, the attacker gains full control over the WordPress instance, enabling them to execute arbitrary code via plugin installations, modify database entries, or exfiltrate sensitive user and site data.\nThe vulnerability is exposed network-wide via the plugin's HTTP interface, requiring no special network positioning other than reachability to the web server's exposed authentication endpoints."
}