Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-288.
Summary
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Really Simple Plugins | Really Simple Security Pro multisite | 9.0.0 – 9.1.1.1 | — | No fix listed | CNA |
| rogierlankhorst | Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | 9.0.0 – 9.1.1.1 | — | No fix listed | CNA |
| Really Simple Plugins | Really Simple Security Pro | 9.0.0 – 9.1.1.1 | — | No fix listed | CNA |
- Really Simple Security Pro multisite VendorReally Simple Plugins Affected 9.0.0 – 9.1.1.1 Fixed in — No fix listed CNA
- Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) Vendorrogierlankhorst Affected 9.0.0 – 9.1.1.1 Fixed in — No fix listed CNA
- Really Simple Security Pro VendorReally Simple Plugins Affected 9.0.0 – 9.1.1.1 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:-:wordpress:*:* | 9.0.0 to before 9.1.2 | Vulnerable | Really Simple Plugins |
| cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro:wordpress:*:* | 9.0.0 to before 9.1.2 | Vulnerable | Really Simple Plugins |
| cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro_multisite:wordpress:*:* | 9.0.0 to before 9.1.2 | Vulnerable | Really Simple Plugins |
- cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:-:wordpress:*:* Versions 9.0.0 to before 9.1.2 Vulnerable ·Really Simple Plugins
- cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro:wordpress:*:* Versions 9.0.0 to before 9.1.2 Vulnerable ·Really Simple Plugins
- cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro_multisite:wordpress:*:* Versions 9.0.0 to before 9.1.2 Vulnerable ·Really Simple Plugins
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-10924
- 2026-10-03 Alias added: GHSA-f75h-cwp9-8h5x
References
Advisory 2
Other 3
- https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67
- https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277
- https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278
Sources
- CVE-2024-10924 · CVE Program
- CVE-2024-10924 · NVD
- FIRST EPSS
- GHSA-f75h-cwp9-8h5x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences