WordPress Plugin Vulnerabilities

Really Simple Security < 9.5.8 - Missing Authorization

Description

The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
really-simple-ssl
Fixed in 9.5.8

References

CVE
CVE-2026-32461
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/68504f49-0b18-4010-97b0-7e7391408d36

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Or Benit
Verified
No
WPVDB ID
4db049b0-8d7f-4deb-b51b-b596e7ae7043

Timeline

Publicly Published
2026-03-15 (about 7 days ago)
Added
2026-03-19 (about 3 days ago)
Last Updated
2026-03-19 (about 3 days ago)

Other

Published
Title
Published
2026-01-24
Title
Protección de datos – RGPD < 0.69 - Missing Authorization
Published
2026-02-18
Title
Mega Store Woocommerce <= 5.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change
Published
2026-02-17
Title
PDF Invoices & Packing Slips for WooCommerce < 5.7.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification
Published
2025-04-04
Title
Easy WP Optimizer <= 1.1.0 - Missing Authorization
Published
2024-12-14
Title
Caldera SMTP Mailer <= 1.0.1 - Missing Authorization