TI-2026-56882 Aliases CVE-2026-82519 GHSA-794h-mjxc-xmmh

Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler

LOW 12CWE-862Published 2026-09-14 · Updated 2026-09-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00363 30th percentileScored 2026-11-07

Fix Fixed Really Simple Security (reallysimpleplugins): 9.8.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Really Simple Plugins	Really Simple Security	before 9.8.2	9.8.2	Patch available	CNA

Really Simple Security VendorReally Simple Plugins Affected before 9.8.2 Fixed in 9.8.2 Patch available CNA

Remediation

Fix · CNA Really Simple Security (reallysimpleplugins) Fixed in 9.8.2

Timeline

2026-10-02 Threatist record created from CVE-2026-82519
2026-10-03 Alias added: GHSA-794h-mjxc-xmmh

References

Other 1

WordPress Changelog

TI-2024-10126 Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass CVSS 3.1CRITICAL 9.8
TI-2022-03225 Complianz (Free < 6.3.4, Premium < 6.3.6) - Translator SQLi CVSS 3.1HIGH 8.8
TI-2023-01012 Complianz - GDPR/CCPA Cookie Consent < 6.4.2 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
TI-2023-05299 SQL injection in rogierlankhorst Burst Statistics – Privacy-Friendly Analytics for… CVSS 3.1CRITICAL 9.8
TI-2023-17559 Cross-site request forgery in Really Simple Plugins Recipe Maker For Your Food Blog from… CVSS 3.1HIGH 8.8
TI-2023-16896 WordPress Complianz and Complianz Premium plugins - Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences