7.5
Élevée
CVE-2026-89080 The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting…
Description
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Really Simple Security 9.5 | 9.5.10.1 → < 9.8.1 | 9.8.1 |
Autres CVE de Really Simple Security
Les 4 CVE de Really Simple Security →
CVE-2026-88798
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using…
5.3
Moyenne
CVE-2026-81766
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really…
6.6
Moyenne
CVE-2026-8293
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of…
7.5
Élevée