Loading story…
A critical authentication bypass vulnerability, CVE-2024-10924, was disclosed and fixed in the WordPress plugin Really Simple Security, affecting the Free, Pro, and Pro Multisite editions in versions 9.0.0 through 9.1.1.1. The flaw carries a CVSS 9.8 rating and can allow an unauthenticated attacker to log in as any user, including an administrator, on sites where the plugin’s two-factor authentication feature is enabled.
The issue was traced to improper error handling in the check_login_and_get_user function within the plugin’s two-factor authentication REST API. Defenders warned that roughly 4 million websites could be exposed, making the bug a high-priority patching issue for WordPress operators. Site owners were urged to update immediately to version 9.1.2 or later to close the vulnerability.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A critical authentication bypass vulnerability, CVE-2024-10924, was fixed in the WordPress plugin Really Simple Security. The flaw affects Free, Pro, and Pro Multisite versions 9.0.0 through 9.1.1.1 when two-factor authentication is enabled, and users were advised to update to version 9.1.2 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical broken authentication flaw tracked as **CVE-2026-57807** affects the miniOrange **OAuth Single Sign On - SSO (OAuth Client)** WordPress plugin and allows unauthenticated remote attackers to compromise vulnerable sites. The issue impacts plugin versions **through 38.5.8** and is classified as **CWE-288**. According to public reporting and the CVE entry, the bug abuses the plugin's password recovery flow to let an attacker authenticate as arbitrary WordPress users, including administrators, creating a direct path to full website takeover. The vulnerability carries a **CVSS 9.8** rating and is considered low complexity and remotely exploitable with no user interaction required. Patchstack disclosed the issue and warned it is likely to face mass exploitation, while noting that no official vendor patch was available at the time of reporting. Defenders were urged to immediately remove the affected plugin or limit exposure to WordPress login and password recovery endpoints until miniOrange releases a fix; Patchstack also said it had issued a virtual patch for protected customers.
Jul 13, 2026
A critical authentication-bypass flaw in the **Burst Statistics** WordPress plugin is being actively exploited to seize administrator access on vulnerable sites. Tracked as `CVE-2026-8181`, the bug affects versions `3.4.0` through `3.4.1.1` and was introduced through improper return-value handling in the plugin’s `is_mainwp_authenticated()` logic for Basic Authentication headers. Security researchers reported that an unauthenticated attacker who knows an administrator username can send arbitrary credentials and be treated as that admin for the request, allowing account impersonation or creation of new administrator accounts on sites running the plugin, which is installed on roughly 200,000 WordPress websites. Wordfence said it observed live attacks and blocked more than 7,400 exploitation attempts in a 24-hour period. Successful compromise could enable follow-on activity including data theft, malware deployment, and malicious site redirection. Defenders were urged to update immediately to **Burst Statistics `3.4.2`** or disable the plugin until patching is possible. Separate disclosures also highlighted another severe WordPress plugin issue, `CVE-2026-6510` in **InfusedWoo Pro** `<= 5.1.2`, where missing authorization checks in the `iwar_save_recipe()` AJAX handler can let unauthenticated attackers craft automation-based authentication bypass leading to administrator-level privilege escalation.
Jun 29, 2026
A critical privilege-escalation flaw, tracked as **CVE-2025-14533**, was disclosed in the WordPress plugin **Advanced Custom Fields: Extended**, enabling an unauthenticated attacker to register or modify a user account with the **administrator** role under certain configurations. The bug was traced to improper role restrictions in the plugin’s user creation and editing form handling, specifically the `insert_user` function, which could allow full compromise of a vulnerable WordPress instance. The issue affects **version `0.9.2.1` and earlier**, and reporting indicated that roughly **100,000 WordPress sites** were affected. Exploitation requires exposed **Create User** or **Update User** forms that make the role field available, increasing risk for sites using those features insecurely. The plugin maintainers released **version `0.9.2.2` and later** to fix the vulnerability, and defenders were urged to update immediately and review sites for unauthorized administrator accounts.
Jul 24, 2026