7.5
High
CVE-2026-89080 The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting…
Description
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Really Simple Security 9.5 | 9.5.10.1 → < 9.8.1 | 9.8.1 |
Other CVEs of Really Simple Security
The 4 CVEs of Really Simple Security →
CVE-2026-88798
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using…
5.3
Medium
CVE-2026-81766
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really…
6.6
Medium
CVE-2026-8293
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of…
7.5
High