WordPress Plugin Vulnerabilities

Really Simple Security < 9.8.2 - Subscriber+ Enforced 2FA Bypass via Grace Period Reset

Description

The plugin is vulnerable to unauthorized access due to a missing capability check on a function, making it possible for authenticated attackers to disable a 2FA grace period and bypass 2FA.

Affects Plugins

Plugin icon
really-simple-ssl
Fixed in 9.8.2

References

CVE
CVE-2026-82519
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/74117559-c55a-4b1f-8b39-3a1852463cc0

Miscellaneous

Original Researcher
Michael Holmquist
Verified
No
WPVDB ID
1eeb0e82-d64a-4f37-bb4e-03fa9842661a

Timeline

Publicly Published
2026-09-14 (about 1 month ago)
Added
2026-09-17 (about 1 month ago)
Last Updated
2026-09-17 (about 1 month ago)

Other

Published
Title
Published
2018-05-10
Title
BBE Theme < 1.53 - Direct Object Reference
Published
2022-04-07
Title
SiteGround Security < 1.2.6 - Authorization Weakness to Authentication Bypass via 2-FA Back-up Codes
Published
2026-10-09
Title
MicroPayments < 3.2.10 - Subscriber+ Payment Bypass
Published
2026-09-08
Title
Simple Cloudflare Turnstile < 1.42.3 - Unauthenticated CAPTCHA Bypass
Published
2018-08-26
Title
Ajax BootModal Login <= 1.4.3 - Captcha Reuse