Loading vulnerability…
Authentication Bypass in Really Simple Security WordPress Plugin
CVE-2024-10924 is a critical authentication bypass vulnerability in the Really Simple Security WordPress plugin family, including Free, Pro, and Pro Multisite editions. It affects versions 9.0.0 through 9.1.1.1 when the plugin’s Two-Factor Authentication feature is enabled. The flaw is caused by improper user-check error handling in the check_login_and_get_user function used by the plugin’s two-factor authentication REST API actions. Under failed login conditions, the function can incorrectly resolve authentication state and associate the request with the user identified by supplied input, allowing an unauthenticated attacker to establish a session as any existing account, including administrative users.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthenticated compromise of arbitrary WordPress user accounts on affected sites, including administrator accounts. This can lead to full site takeover through administrative access, unauthorized modification of site content and configuration, installation of malicious plugins or backdoors, creation of additional privileged accounts, and broader abuse of the WordPress instance for follow-on operations.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the plugin’s Two-Factor Authentication feature to remove the vulnerable code path. Restrict administrative access, monitor for unexpected logins or newly created privileged users, and review plugin and user-account changes for signs of compromise until the fixed version is deployed.
Patch, then assume compromise.
Upgrade Really Simple Security to version 9.1.2 or later. The vulnerable versions are 9.0.0 through 9.1.1.1 across Free, Pro, and Pro Multisite editions. Because the issue is in the plugin’s two-factor authentication REST API logic, applying the vendor-fixed release is the primary remediation.
16 exploits validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.