CVE-2026-8293

Vulnerability

The Really Simple Security WordPress plugin versions prior to 9.5.10.1 fail to enforce the second-factor challenge on two of its two-factor authentication REST endpoints. This vulnerability exists within the plugin's handling of authentication requests [1].

Exploitation

An attacker who possesses a user's valid password can exploit this vulnerability by sending a crafted request to the affected REST endpoints. This bypasses the required email OTP challenge, allowing the attacker to obtain a valid WordPress authentication session for the targeted user without completing the second factor [1].

Impact

Successful exploitation allows an attacker to impersonate a legitimate user and gain unauthorized access to their WordPress account. This can lead to various malicious activities depending on the compromised user's privileges, including content modification, data theft, or further system compromise.

Mitigation

The vulnerability is fixed in Really Simple Security WordPress plugin version 9.5.10.1. Users are strongly advised to update to this version or a later release to remediate the security risk. No workarounds are available for older versions [1].