{ "title": "Really Simple Security vulnerabilities and patches since 2024", "seo_title": "Really Simple Security flaws: 2FA bypasses, exploits, fixes", "h1": "Really Simple Security vulnerabilities and patches since 2024", "description": "The 13 Really Simple Security (formerly Really Simple SSL) vulnerabilities from 2024 to September 2026: CVE-2024-10924, 2FA bypasses, fixed versions.", "lead": "The verified timeline of the 13 Really Simple Security vulnerabilities, from the critical CVE-2024-10924 to the 2026 two-factor authentication bypasses, and the versions to install.", "language": "en", "locale": "en-US", "type": "article", "url": "https://www.wp-masquerade.com/really-simple-security-vulnerabilities/", "canonical": "https://www.wp-masquerade.com/really-simple-security-vulnerabilities/", "markdown": "https://www.wp-masquerade.com/really-simple-security-vulnerabilities/index.md", "json": "https://www.wp-masquerade.com/really-simple-security-vulnerabilities/index.json", "published": "2026-09-27T07:00:00+00:00", "modified": "2026-10-29T07:36:27+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "Really Simple Security vulnerabilities and patches since 2024", "url": "https://www.wp-masquerade.com/really-simple-security-vulnerabilities/", "markdown": "https://www.wp-masquerade.com/really-simple-security-vulnerabilities/index.md", "json": "https://www.wp-masquerade.com/really-simple-security-vulnerabilities/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Really Simple Security : failles et correctifs depuis 2024", "url": "https://www.wp-masquerade.com/fr/failles-securite-really-simple-security/", "markdown": "https://www.wp-masquerade.com/fr/failles-securite-really-simple-security/index.md", "json": "https://www.wp-masquerade.com/fr/failles-securite-really-simple-security/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Really Simple Security: vulnerabilidades y parches desde 2024", "url": "https://www.wp-masquerade.com/es/vulnerabilidades-really-simple-security/", "markdown": "https://www.wp-masquerade.com/es/vulnerabilidades-really-simple-security/index.md", "json": "https://www.wp-masquerade.com/es/vulnerabilidades-really-simple-security/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "Really Simple Security: Lücken und Patches seit 2024", "url": "https://www.wp-masquerade.com/de/really-simple-security-sicherheitsluecken/", "markdown": "https://www.wp-masquerade.com/de/really-simple-security-sicherheitsluecken/index.md", "json": "https://www.wp-masquerade.com/de/really-simple-security-sicherheitsluecken/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Really Simple Security: vulnerabilità e patch dal 2024", "url": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-really-simple-security/", "markdown": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-really-simple-security/index.md", "json": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-really-simple-security/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Really Simple Security: vulnerabilidades e correções desde 2024", "url": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-really-simple-security/", "markdown": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-really-simple-security/index.md", "json": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-really-simple-security/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "Really Simple Security: kwetsbaarheden en patches sinds 2024", "url": "https://www.wp-masquerade.com/nl/really-simple-security-kwetsbaarheden-beveiliging/", "markdown": "https://www.wp-masquerade.com/nl/really-simple-security-kwetsbaarheden-beveiliging/index.md", "json": "https://www.wp-masquerade.com/nl/really-simple-security-kwetsbaarheden-beveiliging/index.json" } ], "headings": [ { "level": 1, "text": "Really Simple Security vulnerabilities and patches since 2024" }, { "level": 2, "text": "Really Simple Security in brief" }, { "level": 2, "text": "Timeline of the vulnerabilities, from 2024 to September 2026" }, { "level": 2, "text": "The notable vulnerabilities explained" }, { "level": 3, "text": "November 2024: CVE-2024-10924, logging in without a password" }, { "level": 3, "text": "May and June 2026: the second factor bypassed with the password" }, { "level": 3, "text": "August 2026: installing a plugin from a subsite" }, { "level": 3, "text": "September 2026: three fix releases in fifteen days" }, { "level": 3, "text": "The minor vulnerabilities" }, { "level": 2, "text": "What this history shows" }, { "level": 2, "text": "Protecting your site" }, { "level": 3, "text": "Key takeaways" }, { "level": 2, "text": "Sources" }, { "level": 2, "text": "WordPress security, without the noise", "id": "wpm-nl-box-title" } ], "body": "A security plugin is not immune to vulnerabilities, and Really Simple Security is a very well-documented example: thirteen vulnerabilities published between April 2024 and September 2026, including a critical one in 2024 and a series of [two-factor authentication](https://www.wp-masquerade.com/glossary/two-factor-authentication/) bypasses in 2026. Here is the complete timeline, verified entry by entry, what each vulnerability actually allowed and the versions to install to stay safe.\n\n## Really Simple Security in brief\n\nReally Simple Security is the former Really Simple SSL, published on wordpress.org since March 2015 by the vendor Really Simple Plugins (slug `really-simple-ssl`). The plugin first became known for enabling HTTPS in one click and fixing mixed content. It then added security features: hardening, vulnerability detection, login limiting, [security headers](https://www.wp-masquerade.com/glossary/http-security-headers/) and two-factor authentication (2FA). A paid Pro edition completes the lineup.\n\nIt has more than 3 million active installations according to wordpress.org (Wordfence put the figure at more than 4 million, Pro editions included, in late 2024). Two reasons make it a prime target. The first is its reach: a vulnerability exploitable without an account quickly turns into a large-scale automated attack. The second is its function: the code that handles login and 2FA directly decides who gets into the admin area. A mistake there does not leak some secondary piece of data, it opens the door.\n\n## Timeline of the vulnerabilities, from 2024 to September 2026\n\nThe WPScan database lists 13 vulnerabilities for this plugin, all published from April 2024 onward: no older entry appears there. Patchstack lists 12, because it treats two September 2026 identifiers as the same vulnerability. Ten of the thirteen entries date from 2026, and five of them concern two-factor authentication.\n\n![Vertical timeline of Really Simple Security vulnerabilities: administrator-only SSRF on April 16, 2024 (fixed in 8.0.0), critical CVE-2024-10924 on November 14, 2024 (fixed in 9.1.2 with a forced update), CSRF on January 24, 2025 (9.2.0), missing access control on March 15, 2026 (9.5.8), email second factor bypass on May 12, 2026 (9.5.10.1), two missing access controls on June 3, 2026, plugin installation on multisite on August 28, 2026 (9.8.0), 2FA bypass and denial of service on September 2, 2026 (9.8.1), 2FA reset on September 11 (9.8.1), 2FA grace period extended on September 14 (9.8.2) and an option inflated by fake IP addresses on September 16, 2026 (9.8.3).](https://www.wp-masquerade.com/media/2026/10/chronologie-failles-really-simple-security-en.webp)\n\n*The thirteen published vulnerabilities, grouped into eleven dates. Severity from the CVSS score shown by WPScan.*\n\n| Published | Fixed in | Type | CVSS | CVE | Account required | Exploitation |\n| --- | --- | --- | --- | --- | --- | --- |\n| April 16, 2024 | 8.0.0 | Server-side request forgery (SSRF) | 5.5 | CVE-2024-31229 | Administrator | None documented |\n| November 14, 2024 | 9.1.2 (affected: 9.0.0 to 9.1.1.1, free, Pro, Pro Multisite) | Authentication bypass (2FA enabled) | 9.8 | CVE-2024-10924 | None | Public exploit code; attempts observed by CrowdSec |\n| January 24, 2025 | 9.2.0 | Cross-site request forgery (CSRF) | 4.3 | CVE-2025-24623 | None (an administrator must click) | None documented |\n| March 15, 2026 | 9.5.8 | Missing access control | 4.3 | CVE-2026-32461 | Subscriber | None documented |\n| May 12, 2026 | 9.5.10.1 | Email second factor bypass | 7.5 (WPScan) | CVE-2026-8293 | None, password known | None documented |\n| June 3, 2026 | 9.5.10 | Missing access control | 6.5 (WPScan 4.3) | CVE-2026-48969 | Subscriber | None documented |\n| June 3, 2026 | 9.5.10.1 | Broken authentication | 8.1 (WPScan 5.3) | CVE-2026-48970 | None, password known | None documented |\n| August 28, 2026 | 9.8.0 | Arbitrary plugin installation on multisite | 6.6 (WPScan) | CVE-2026-81766 | Subsite administrator | None documented |\n| September 2, 2026 | 9.8.1 | Denial of service | 5.3 (WPScan 7.5) | CVE-2026-84775 | None | None documented |\n| September 2, 2026 | 9.8.1 | 2FA bypass | 7.4 (WPScan 7.5) | CVE-2026-84777 | None | None documented |\n| September 11, 2026 | 9.8.1 (affected: 9.5.10.1 to 9.8.0) | Email 2FA reset | 7.5 (WPScan) | CVE-2026-89080 | None, password known | None documented |\n| September 14, 2026 | 9.8.2 | 2FA grace period extended indefinitely | 4.3 | CVE-2026-82519 | Subscriber | None documented |\n| September 16, 2026 | 9.8.3 (affected: 8.1.6 to 9.8.2) | Unbounded option growth (denial of service) | 6.5 (WPScan) | CVE-2026-88798 | None | None documented |\n\n*The 13 vulnerabilities published in WPScan up to September 24, 2026. WPScan publication date; CVSS from the organization that assigned the CVE (Patchstack, Wordfence or VulnCheck), or from WPScan when it did, with the WPScan score in parentheses if it differs.*\n\nTwo scoring discrepancies are worth pointing out. For CVE-2026-48970, Patchstack uses 8.1, while WPScan and Wordfence show 5.3. For the CVE-2026-84775 denial of service, it is the reverse: 5.3 at Patchstack, 7.5 at WPScan. The score depends on the assumptions made about attack conditions, which is why it pays to read the description rather than just the number.\n\n## The notable vulnerabilities explained\n\n### November 2024: CVE-2024-10924, logging in without a password\n\nThis is the most severe vulnerability in the history, rated 9.8. In versions 9.0.0 to 9.1.1.1, a 2FA-related REST API route logged in the requested user even when the verification token was invalid. An anonymous visitor could thus open an administrator session, provided 2FA was enabled on the site (it is not by default). István Márton of Wordfence reported it on November 6, 2024; version 9.1.2 came out on November 12 for the Pro editions and on November 14 for the free edition, with a forced update coordinated with the wordpress.org plugins team. We detailed the mechanism and the response in our [analysis of CVE-2024-10924](https://www.wp-masquerade.com/really-simple-security-cve-2024-10924-2fa-bypass/).\n\nExploit code was published shortly after disclosure. The CrowdSec tracker reports observing a first real-world exploitation on November 25, 2024, while noting that it saw no significant activity on its network. The vulnerability is not in CISA's KEV catalog.\n\n### May and June 2026: the second factor bypassed with the password\n\nIn 2026, the plugin's 2FA became the main weak spot again, but with a different scenario. CVE-2026-8293, published by WPScan on May 12 and reported by John Umoru, describes two 2FA REST endpoints that did not actually require the code sent by email: an attacker who already knew an account's password got a session without passing the second factor. CVE-2026-48970, reported to Patchstack on April 17 and published on June 3, is of the same type (broken authentication, victim's password required according to Patchstack). Both are fixed by version 9.5.10.1 of April 29, 2026, whose changelog mentions an update to the 2FA login flow.\n\nThese vulnerabilities do not open a site to just anyone. They do, however, cancel out the protection 2FA exists for: stopping an attacker who has obtained a password through a leak, phishing or reuse. The fix was available several weeks before the records were published, which gave a head start to sites with automatic updates.\n\n### August 2026: installing a plugin from a subsite\n\nCVE-2026-81766, reported by Charles Vosburgh and published by WPScan on August 28, 2026, only affects multisite networks. The function that installs recommended plugins (`rsp_upgrade_install_plugin`) did not check that the user was allowed to install plugins. The administrator of a mere subsite could therefore drop and run code in the plugins folder shared by the whole network, a right normally reserved for the super administrator. An important condition: the super administrator must have opened the Plugins menu to subsites, which is not the default setting. Fix: 9.8.0, released on August 25, 2026.\n\n### September 2026: three fix releases in fifteen days\n\nIn early September, several researchers targeted the same area of the code, and the vendor shipped versions 9.8.1 (September 1), 9.8.2 (September 14) and 9.8.3 (September 15) in quick succession.\n\n- **Unauthenticated 2FA bypass (CVE-2026-84777)**: reported to Patchstack by Ananda Dhakal on August 20, fixed in 9.8.1 and published on September 2, rated 7.4. Patchstack notes that another authority published the same issue as CVE-2026-89080, which WPScan describes as the unauthenticated reset of an already completed email 2FA enrollment, letting an attacker who knows the password obtain the session, up to administrator level. According to WPScan, the latter affects versions from 9.5.10.1 onward.\n- **Unauthenticated denial of service (CVE-2026-84775)**: reported by the same researcher, fixed in the same version 9.8.1.\n- **Extended grace period (CVE-2026-82519)**: a logged-in user, even a subscriber, could reset the grace period granted before 2FA becomes mandatory for them, and postpone that requirement indefinitely. Fixed in 9.8.2.\n- **Option inflated by fake IP addresses (CVE-2026-88798)**: the module that monitors 404 errors stored the IP address declared by the client as an option key, without validation. An anonymous visitor could make this option grow without limit and slow down the handling of not-found pages. Fixed in 9.8.3.\n\nThe 9.8.3 changelog also mentions fixing a \"remaining 2FA bypass in [XML-RPC](https://www.wp-masquerade.com/glossary/xml-rpc/) authentication\", with no associated vulnerability record in the databases consulted.\n\n### The minor vulnerabilities\n\nThe rest of the history is of medium severity: an SSRF exploitable only by an administrator (2024, reported by Ananda Dhakal of Patchstack), a CSRF that requires tricking an administrator (2025) and two missing access controls open to a mere subscriber (March and June 2026). On a site without public registration, the risk of the \"subscriber\" vulnerabilities remains limited, but it becomes real on a store or a membership site.\n\n![Bars per year according to WPScan: 2 vulnerabilities in 2024 (1 critical, 1 medium), 1 vulnerability in 2025 (medium), 10 vulnerabilities in 2026 up to September 24 (4 high, 6 medium).](https://www.wp-masquerade.com/media/2026/10/failles-par-annee-really-simple-security-en.webp)\n\n*Number of vulnerabilities per year in the WPScan database, from April 16, 2024 to September 16, 2026.*\n\n## What this history shows\n\n- **2FA concentrates the vulnerabilities.** One critical vulnerability in 2024, then five records in 2026 (CVE-2026-8293, 48970, 84777, 89080 and 82519) concern the second factor or its enforcement. Version 9.5.10.1, which fixed the 2FA login flow, is itself affected by CVE-2026-89080 according to WPScan: authentication code is the trickiest part of a security plugin.\n- **The 2026 surge also reflects researchers' attention.** Ten records in nine months, from Patchstack, WPScan and VulnCheck, often through bug bounty programs. More reports do not mean worse code than elsewhere, but a widely installed, security-related plugin gets close scrutiny.\n- **Fixes arrive quickly.** Eight days between report and fix for CVE-2024-10924, twelve days for CVE-2026-48970, twelve days as well for CVE-2026-84777. In several cases, the fixed version came out before the record was published.\n- **Forced updates remain the exception.** One is documented in 2024 for the critical vulnerability; we found no mention of a forced update for the 2026 vulnerabilities. Sites without automatic updates therefore stayed exposed until their administrator stepped in.\n- **A relative upside of the 2026 bypasses**: most assume the attacker already knows the password. A unique, strong password therefore limits their reach, which was not the case in 2024.\n\nThis pattern is not specific to Really Simple Security: our [timeline of WordPress core security releases](https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/) and our [figures on vulnerable plugins](https://www.wp-masquerade.com/wordpress-plugin-vulnerabilities-statistics/) show that all widely deployed software goes through this rhythm. What matters is how quickly the fix reaches your site.\n\n*The critical CVE-2024-10924 vulnerability explained in six minutes, by Code Canvas (in English).*\n\n## Protecting your site\n\n- **Check the version** in Plugins: 9.8.3 or later fixes every vulnerability listed here. With a Pro edition, make sure the license is active, because an expired license no longer receives updates.\n- **Turn on automatic updates** for this plugin, as explained in our guide to automatic plugin updates. The 2026 vulnerabilities show that you should not count on a forced update.\n- **Keep 2FA**, but do not treat it as the only barrier: unique passwords and login attempt limiting reduce the value of bypasses that assume a known password. Our article on [two-factor authentication](https://www.wp-masquerade.com/wordpress-two-factor-authentication/) details best practices.\n- **Avoid duplicates**: if another plugin already handles 2FA or login security, disable the duplicate feature or delete the unnecessary plugin (see abandoned and unnecessary plugins). Less active code means less attack surface.\n- **Add a web application firewall** capable of virtual patching (WAF comparison). In 2024, Wordfence shipped a rule on November 6 for its paying customers and on December 6 for the free version; Patchstack, on the other hand, states that no virtual patch was possible for CVE-2026-48970 or CVE-2026-84777.\n- **Monitor published vulnerabilities** for your installed plugins, as described in our article on vulnerability monitoring.\n\nWP Masquerade Pro can help with this last point, without replacing updates. Every day it compares the installed versions of your plugins and themes with the public WPVulnerability.net database and sends you a [vulnerability alert](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) by [email](https://www.wp-masquerade.com/features/email-alerts/) with the severity and the fixed version. Pending updates and vulnerable sites appear in the member area ([site monitoring](https://www.wp-masquerade.com/features/#surveillance)). WP Masquerade does not fix vulnerabilities and is not a firewall: it warns you so that you apply the fix in time. To compare security plugins, see our [selection of the best WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/).\n\n### Key takeaways\n\n- 13 vulnerabilities published in WPScan from April 2024 to September 24, 2026, 10 of them in 2026.\n- Only one critical: CVE-2024-10924 (9.8), fixed in 9.1.2 with a forced update.\n- Five 2026 records concern two-factor authentication; most assume an already known password.\n- Recommended minimum version as of September 24, 2026: 9.8.3.\n- Automatic updates, unique passwords and vulnerability monitoring remain the best defenses.\n\n## Sources\n\n- WordPress.org: Really Simple Security, changelog (versions 9.1.2 to 9.8.3) (https://wordpress.org/plugins/really-simple-ssl/#developers)\n- NVD: CVE-2024-10924 (November 15, 2024) (https://nvd.nist.gov/vuln/detail/CVE-2024-10924)\n- CVE.org: CVE-2024-31229, Really Simple SSL up to 7.2.3 SSRF (April 18, 2024) (https://www.cve.org/CVERecord?id=CVE-2024-31229)\n- CISA: Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n\nOther sources consulted: further CVE records, official vendor pages, security research publications, Wordfence, WPScan and Patchstack databases.\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.", "categories": [ "Vulnerable plugins" ], "format": "application/json" }