Authentication Bypass in Really Simple Security Plugin Exposes WordPress Admin Access
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Nov 15, 2024
A critical authentication bypass vulnerability, CVE-2024-10924, was disclosed and fixed in the WordPress plugin Really Simple Security, affecting the Free, Pro, and Pro Multisite editions in versions 9.0.0 through 9.1.1.1. The flaw carries a CVSS 9.8 rating and can allow an unauthenticated attacker to log in as any user, including an administrator, on sites where the plugin’s two-factor authentication feature is enabled.
The issue was traced to improper error handling in the check_login_and_get_user function within the plugin’s two-factor authentication REST API. Defenders warned that roughly 4 million websites could be exposed, making the bug a high-priority patching issue for WordPress operators. Site owners were urged to update immediately to version 9.1.2 or later to close the vulnerability.
