{
    "title": "Really Simple Security CVE-2024-10924: the flaw that bypassed 2FA",
    "seo_title": "Really Simple Security: the CVE-2024-10924 flaw",
    "h1": "Really Simple Security CVE-2024-10924: the flaw that bypassed 2FA",
    "description": "CVE-2024-10924: a critical authentication bypass in Really Simple Security. Root cause, timeline and what this flaw reveals about 2FA.",
    "lead": "A security plugin installed on more than 4 million sites let attackers log in as an administrator without a password. A breakdown of CVE-2024-10924.",
    "language": "en",
    "locale": "en-US",
    "type": "article",
    "url": "https://www.wp-masquerade.com/really-simple-security-cve-2024-10924-2fa-bypass/",
    "canonical": "https://www.wp-masquerade.com/really-simple-security-cve-2024-10924-2fa-bypass/",
    "markdown": "https://www.wp-masquerade.com/really-simple-security-cve-2024-10924-2fa-bypass/index.md",
    "json": "https://www.wp-masquerade.com/really-simple-security-cve-2024-10924-2fa-bypass/index.json",
    "published": "2026-10-11T07:00:00+00:00",
    "modified": "2026-10-29T02:18:45+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "Really Simple Security CVE-2024-10924: the flaw that bypassed 2FA",
            "url": "https://www.wp-masquerade.com/really-simple-security-cve-2024-10924-2fa-bypass/",
            "markdown": "https://www.wp-masquerade.com/really-simple-security-cve-2024-10924-2fa-bypass/index.md",
            "json": "https://www.wp-masquerade.com/really-simple-security-cve-2024-10924-2fa-bypass/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Really Simple Security CVE-2024-10924 : la faille qui contournait la 2FA",
            "url": "https://www.wp-masquerade.com/fr/really-simple-security-cve-2024-10924/",
            "markdown": "https://www.wp-masquerade.com/fr/really-simple-security-cve-2024-10924/index.md",
            "json": "https://www.wp-masquerade.com/fr/really-simple-security-cve-2024-10924/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Really Simple Security CVE-2024-10924: la vulnerabilidad que se saltaba la 2FA",
            "url": "https://www.wp-masquerade.com/es/really-simple-security-cve-2024-10924-2fa-vulnerabilidad/",
            "markdown": "https://www.wp-masquerade.com/es/really-simple-security-cve-2024-10924-2fa-vulnerabilidad/index.md",
            "json": "https://www.wp-masquerade.com/es/really-simple-security-cve-2024-10924-2fa-vulnerabilidad/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Really Simple Security CVE-2024-10924: die Lücke, die die 2FA umging",
            "url": "https://www.wp-masquerade.com/de/really-simple-security-cve-2024-10924-2fa-umgehung/",
            "markdown": "https://www.wp-masquerade.com/de/really-simple-security-cve-2024-10924-2fa-umgehung/index.md",
            "json": "https://www.wp-masquerade.com/de/really-simple-security-cve-2024-10924-2fa-umgehung/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Really Simple Security CVE-2024-10924: la falla che aggirava la 2FA",
            "url": "https://www.wp-masquerade.com/it/really-simple-security-cve-2024-10924-2fa-falla/",
            "markdown": "https://www.wp-masquerade.com/it/really-simple-security-cve-2024-10924-2fa-falla/index.md",
            "json": "https://www.wp-masquerade.com/it/really-simple-security-cve-2024-10924-2fa-falla/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Really Simple Security CVE-2024-10924: a falha que contornava a 2FA",
            "url": "https://www.wp-masquerade.com/pt/really-simple-security-cve-2024-10924-2fa-falha/",
            "markdown": "https://www.wp-masquerade.com/pt/really-simple-security-cve-2024-10924-2fa-falha/index.md",
            "json": "https://www.wp-masquerade.com/pt/really-simple-security-cve-2024-10924-2fa-falha/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Really Simple Security CVE-2024-10924: het lek dat 2FA omzeilde",
            "url": "https://www.wp-masquerade.com/nl/really-simple-security-cve-2024-10924-2fa-lek/",
            "markdown": "https://www.wp-masquerade.com/nl/really-simple-security-cve-2024-10924-2fa-lek/index.md",
            "json": "https://www.wp-masquerade.com/nl/really-simple-security-cve-2024-10924-2fa-lek/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "Really Simple Security CVE-2024-10924: the flaw that bypassed 2FA"
        },
        {
            "level": 2,
            "text": "CVE-2024-10924 at a glance"
        },
        {
            "level": 2,
            "text": "How the bypass worked"
        },
        {
            "level": 2,
            "text": "Why it was serious"
        },
        {
            "level": 2,
            "text": "The timeline and the forced updates"
        },
        {
            "level": 2,
            "text": "What to do if you use this plugin"
        },
        {
            "level": 2,
            "text": "The lesson: two-factor authentication is still essential, but not just any implementation"
        },
        {
            "level": 2,
            "text": "What the forced update teaches us"
        },
        {
            "level": 3,
            "text": "Key takeaways"
        },
        {
            "level": 2,
            "text": "Sources"
        },
        {
            "level": 2,
            "text": "WordPress security, without the noise",
            "id": "wpm-nl-box-title"
        }
    ],
    "body": "In November 2024, a plugin installed on more than four million WordPress sites found itself at the center of a major alert. Really Simple Security, a plugin whose job is precisely to strengthen security, contained a vulnerability that allowed anyone to log in as an administrator without a password. Here is what happened, why the flaw was so serious, and what this episode teaches us about two-factor authentication.\n\n## CVE-2024-10924 at a glance\n\nThe vulnerability is tracked as CVE-2024-10924 and has a [CVSS score](https://www.wp-masquerade.com/glossary/cvss/) of 9.8 out of 10, which puts it in the critical category. It affects Really Simple Security (formerly Really Simple SSL) in its free, Pro and Pro Multisite editions. It is an authentication bypass: an anonymous visitor could impersonate any existing account, including an administrator, and take over the site.\n\n| Item | Verified detail |\n| --- | --- |\n| Identifier | CVE-2024-10924 |\n| Severity | CVSS 9.8 (critical) |\n| Vulnerable versions | 9.0.0 to 9.1.1.1 (free, Pro, Pro Multisite) |\n| Fixed version | 9.1.2 |\n| Exploitation condition | Two-factor authentication enabled (disabled by default) |\n| Active installations | More than 4 million (free edition) |\n| Discovery | November 6, 2024, Wordfence team |\n\n*The key facts about CVE-2024-10924, based on the Wordfence advisory and the NVD entry.*\n\n## How the bypass worked\n\nThe flaw was in the plugin's two-factor authentication feature, and more precisely in its actions exposed through the REST API. When a user validates a two-factor code, the code checks two parameters: the user's ID (`user_id`) and a single-use token (`login_nonce`). The function at fault is called `check_login_and_get_user`.\n\nThe problem came from the error handling. When the `login_nonce` token was invalid, the request was not rejected. The code still called an authentication function that logged the user in based solely on the supplied `user_id`. In other words, all it took was sending a request to the relevant REST route (`reallysimplessl/v1/two_fa/skip_onboarding`) with a user ID and a bogus token to get a valid session. Since ID 1 often belongs to the first administrator, the takeover was immediate.\n\n![Comparison between a legitimate four-step login with token verification and a six-digit code, and the attacker's request that results in an administrator login despite an invalid token.](https://www.wp-masquerade.com/media/2026/10/flux-attaque-en.webp)\n\n*On the left, the normal login. On the right, the path taken by the attack: the invalid token does not stop the request.*\n\nOne detail makes the situation paradoxical: the flaw could only be exploited if the plugin's two-factor authentication was enabled. Yet this option is disabled by default. The most cautious sites, the ones that had taken the trouble to turn on an extra layer of protection, were therefore precisely the ones exposed. The fix consists of stopping the function immediately as soon as the token check fails.\n\n## Why it was serious\n\nThree factors combined to make this flaw a textbook case.\n\n- **Scale.** With more than four million installations of the free version alone, the attack surface was huge.\n- **Simplicity.** The bypass required no prior authentication and could be automated. Proof-of-concept code was in fact published on GitHub shortly after disclosure.\n- **The target.** The flaw gave administrator access directly, the highest privilege level, which opens the door to installing backdoors, stealing data and defacing the site.\n\nThe Wordfence researchers who discovered it called it the most dangerous vulnerability they had come across in twelve years of working on WordPress security. That judgment deserves to be taken seriously, coming from a team that handles thousands of advisories every year.\n\n## The timeline and the forced updates\n\nThe response was fast. István Márton of the Wordfence team reported the flaw on November 6, 2024. The vendor released fixed version 9.1.2 for the Pro editions on November 12, then for the free edition on November 14. Notably, given the severity, the vendor worked with the WordPress.org plugins team to push a forced update to the fixed version, even to sites that had disabled automatic updates.\n\n![Timeline of November 2024: discovery on the 6th, Pro fix on the 12th, free fix on the 14th and forced updates through WordPress.org.](https://www.wp-masquerade.com/media/2026/10/chronologie-en-4.webp)\n\n*Less than ten days passed between discovery and fix.*\n\nForced updates do not cover every case. Sites whose Pro license had expired no longer receive automatic updates and therefore had to apply the fix manually. It is a useful reminder: an expired license is not just a matter of support, it can also mean no security fixes.\n\n*A general-audience summary of the flaw and its consequences.*\n\n## What to do if you use this plugin\n\n- Check under **Plugins** that Really Simple Security is at version 9.1.2 or later. Any version from 9.0.0 to 9.1.1.1 is vulnerable.\n- If your Pro license has expired, update manually, since the forced update may not have reached you.\n- If you suspect an intrusion that took place before the fix, review the list of administrator accounts and look for suspicious new ones.\n- Check the integrity of core and plugin files to spot any modifications.\n\nTo dig deeper into signs of compromise, our article on the signs of a hacked WordPress site details the checks to carry out.\n\n## The lesson: two-factor authentication is still essential, but not just any implementation\n\nIt would be absurd to conclude from this episode that you should not use two-factor authentication. Quite the opposite: 2FA remains one of the most effective protections against credential theft and [brute force](https://www.wp-masquerade.com/glossary/brute-force-attack/). The real lesson lies elsewhere. A protection is only as good as its implementation, and a logic flaw in the code that verifies sessions can cancel out all the expected benefit.\n\nThis argues for two habits. First, update security plugins without delay: they are prime targets precisely because they handle authentication. Second, prefer simple, well-tested and well-documented mechanisms. The two-factor authentication in [WP Masquerade Pro](https://www.wp-masquerade.com/features/two-factor-authentication/) relies on one-time codes generated by an authenticator app, with ten single-use backup codes and the option to make it mandatory by role. The secret is generated locally and is not sent to any external service. As a last resort, a switch in `wp-config.php` (`define('CMP_DISABLE_2FA', true);`) lets you suspend verification for the whole site if a problem occurs, without touching the rest of the configuration.\n\nNo plugin guarantees absolute security, and WP Masquerade is no exception. But reducing the exposed surface, limiting login attempts and having a clear way to recover remain the best posture against flaws that, sooner or later, end up affecting even security tools. To see which other plugins offer two-factor authentication and login protection, read our [comparison of the best WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/).\n\n*A technical demonstration of the flaw in a controlled training environment.*\n\n## What the forced update teaches us\n\nThe forced update coordinated with WordPress.org is a rare measure, reserved for the most serious situations. It is worth pausing on, because it sums up the tension at the heart of WordPress security. On the one hand, pushing a fix to millions of sites without their explicit consent limits the risk of a wave of intrusions. On the other, it is a reminder that part of the install base does not update on its own, and that without this nudge, many sites would have stayed vulnerable for much longer.\n\nFor a site owner, the takeaway is not to depend on these exceptional measures. Automatic plugin updates, when enabled, and regular monitoring of fixes remain the basic defense. A forced update is a safety net, not a strategy.\n\n### Key takeaways\n\n- CVE-2024-10924: a critical authentication bypass (CVSS 9.8) in Really Simple Security 9.0.0 to 9.1.1.1.\n- The fix is version 9.1.2, released in November 2024, with a forced update through WordPress.org.\n- The flaw was only active if the plugin's two-factor authentication was enabled.\n- A security plugin is a prime target: update it first and keep a valid license.\n\n## Sources\n\n- [Wordfence, security advisory on Really Simple Security (CVE-2024-10924)](https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/)\n- [NVD, CVE-2024-10924 entry](https://nvd.nist.gov/vuln/detail/CVE-2024-10924)\n\nOther sources consulted: security research publications and trade press articles.\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.",
    "categories": [
        "Vulnerable plugins"
    ],
    "format": "application/json"
}