7.5
High
CVE-2026-8293 The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of…
Description
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Really Simple Security 9.5 | earliest → < 9.5.10.1 | 9.5.10.1 |
Other CVEs of Really Simple Security
The 4 CVEs of Really Simple Security →
CVE-2026-88798
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using…
5.3
Medium
CVE-2026-89080
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting…
7.5
High
CVE-2026-81766
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really…
6.6
Medium