In November 2024, a plugin installed on more than four million WordPress sites found itself at the center of a major alert. Really Simple Security, a plugin whose job is precisely to strengthen security, contained a vulnerability that allowed anyone to log in as an administrator without a password. Here is what happened, why the flaw was so serious, and what this episode teaches us about two-factor authentication.
CVE-2024-10924 at a glance
The vulnerability is tracked as CVE-2024-10924 and has a CVSS score of 9.8 out of 10, which puts it in the critical category. It affects Really Simple Security (formerly Really Simple SSL) in its free, Pro and Pro Multisite editions. It is an authentication bypass: an anonymous visitor could impersonate any existing account, including an administrator, and take over the site.
| Item | Verified detail |
|---|---|
| Identifier | CVE-2024-10924 |
| Severity | CVSS 9.8 (critical) |
| Vulnerable versions | 9.0.0 to 9.1.1.1 (free, Pro, Pro Multisite) |
| Fixed version | 9.1.2 |
| Exploitation condition | Two-factor authentication enabled (disabled by default) |
| Active installations | More than 4 million (free edition) |
| Discovery | November 6, 2024, Wordfence team |
How the bypass worked
The flaw was in the plugin's two-factor authentication feature, and more precisely in its actions exposed through the REST API. When a user validates a two-factor code, the code checks two parameters: the user's ID (user_id) and a single-use token (login_nonce). The function at fault is called check_login_and_get_user.
The problem came from the error handling. When the login_nonce token was invalid, the request was not rejected. The code still called an authentication function that logged the user in based solely on the supplied user_id. In other words, all it took was sending a request to the relevant REST route (reallysimplessl/v1/two_fa/skip_onboarding) with a user ID and a bogus token to get a valid session. Since ID 1 often belongs to the first administrator, the takeover was immediate.
One detail makes the situation paradoxical: the flaw could only be exploited if the plugin's two-factor authentication was enabled. Yet this option is disabled by default. The most cautious sites, the ones that had taken the trouble to turn on an extra layer of protection, were therefore precisely the ones exposed. The fix consists of stopping the function immediately as soon as the token check fails.
Why it was serious
Three factors combined to make this flaw a textbook case.
- Scale. With more than four million installations of the free version alone, the attack surface was huge.
- Simplicity. The bypass required no prior authentication and could be automated. Proof-of-concept code was in fact published on GitHub shortly after disclosure.
- The target. The flaw gave administrator access directly, the highest privilege level, which opens the door to installing backdoors, stealing data and defacing the site.
The Wordfence researchers who discovered it called it the most dangerous vulnerability they had come across in twelve years of working on WordPress security. That judgment deserves to be taken seriously, coming from a team that handles thousands of advisories every year.
The timeline and the forced updates
The response was fast. István Márton of the Wordfence team reported the flaw on November 6, 2024. The vendor released fixed version 9.1.2 for the Pro editions on November 12, then for the free edition on November 14. Notably, given the severity, the vendor worked with the WordPress.org plugins team to push a forced update to the fixed version, even to sites that had disabled automatic updates.
Forced updates do not cover every case. Sites whose Pro license had expired no longer receive automatic updates and therefore had to apply the fix manually. It is a useful reminder: an expired license is not just a matter of support, it can also mean no security fixes.
What to do if you use this plugin
- Check under Plugins that Really Simple Security is at version 9.1.2 or later. Any version from 9.0.0 to 9.1.1.1 is vulnerable.
- If your Pro license has expired, update manually, since the forced update may not have reached you.
- If you suspect an intrusion that took place before the fix, review the list of administrator accounts and look for suspicious new ones.
- Check the integrity of core and plugin files to spot any modifications.
To dig deeper into signs of compromise, our article on the signs of a hacked WordPress site details the checks to carry out.
The lesson: two-factor authentication is still essential, but not just any implementation
It would be absurd to conclude from this episode that you should not use two-factor authentication. Quite the opposite: 2FA remains one of the most effective protections against credential theft and brute force. The real lesson lies elsewhere. A protection is only as good as its implementation, and a logic flaw in the code that verifies sessions can cancel out all the expected benefit.
This argues for two habits. First, update security plugins without delay: they are prime targets precisely because they handle authentication. Second, prefer simple, well-tested and well-documented mechanisms. The two-factor authentication in WP Masquerade Pro relies on one-time codes generated by an authenticator app, with ten single-use backup codes and the option to make it mandatory by role. The secret is generated locally and is not sent to any external service. As a last resort, a switch in wp-config.php (define('CMP_DISABLE_2FA', true);) lets you suspend verification for the whole site if a problem occurs, without touching the rest of the configuration.
No plugin guarantees absolute security, and WP Masquerade is no exception. But reducing the exposed surface, limiting login attempts and having a clear way to recover remain the best posture against flaws that, sooner or later, end up affecting even security tools. To see which other plugins offer two-factor authentication and login protection, read our comparison of the best WordPress security plugins.
What the forced update teaches us
The forced update coordinated with WordPress.org is a rare measure, reserved for the most serious situations. It is worth pausing on, because it sums up the tension at the heart of WordPress security. On the one hand, pushing a fix to millions of sites without their explicit consent limits the risk of a wave of intrusions. On the other, it is a reminder that part of the install base does not update on its own, and that without this nudge, many sites would have stayed vulnerable for much longer.
For a site owner, the takeaway is not to depend on these exceptional measures. Automatic plugin updates, when enabled, and regular monitoring of fixes remain the basic defense. A forced update is a safety net, not a strategy.
Key takeaways
- CVE-2024-10924: a critical authentication bypass (CVSS 9.8) in Really Simple Security 9.0.0 to 9.1.1.1.
- The fix is version 9.1.2, released in November 2024, with a forced update through WordPress.org.
- The flaw was only active if the plugin's two-factor authentication was enabled.
- A security plugin is a prime target: update it first and keep a valid license.
Sources
- Wordfence, security advisory on Really Simple Security (CVE-2024-10924) (opens in a new tab)
- NVD, CVE-2024-10924 entry (opens in a new tab)
Other sources consulted: security research publications and trade press articles.
