WordPress Plugin Vulnerabilities

Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion

Description

The plugin does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

Proof of Concept

Affects Plugins

Plugin icon
really-simple-ssl
Fixed in 9.8.1

References

CVE
CVE-2026-89080

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Charles Vosburgh
Submitter
Charles Vosburgh
Submitter website
https://www.linkedin.com/in/charles-vosburgh/
Verified
Yes
WPVDB ID
49546064-5663-40f8-be7c-4f3faa31fa9a

Timeline

Publicly Published
2026-09-11 (about 2 days ago)
Added
2026-09-11 (about 1 day ago)
Last Updated
2026-09-11 (about 1 day ago)

Other

Published
Title
Published
2025-11-18
Title
YITH WooCommerce Wishlist < 4.10.1 - Wishlist Item Deletion via Wishlist Token Disclosure
Published
2026-08-20
Title
SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass
Published
2024-07-08
Title
WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials
Published
2021-07-19
Title
Profile Builder < 3.4.9 - Admin Access via Password Reset
Published
2024-08-14
Title
MStore API – Create Native Android & iOS Apps On The Cloud < 4.15.3 - Authentication Bypass to Account Takeover