The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

The WordPress application running on the remote host has a version of the 'Really Simple Security' plugin that is 9.0.x prior to 9.1.2. It is, therefore, affected by an authentication bypass vulnerability. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the 'Two-Factor Authentication' setting is enabled (disabled by default). 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The WordPress application running on the remote host has a version of the 'Really Simple Security Pro' plugin that is 9.0.x prior to 9.1.2. It is, therefore, affected by an authentication bypass vulnerability. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the 'Two-Factor Authentication' setting is enabled (disabled by default). 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The WordPress application running on the remote host has a version of the 'Really Simple Security Pro Multisite' plugin that is 9.0.x prior to 9.1.2. It is, therefore, affected by an authentication bypass vulnerability. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the 'Two-Factor Authentication' setting is enabled (disabled by default). 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The WordPress Really Simple Security Plugin installed on the remote host is affected by an Authentication Bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211681	WordPress Plugin 'Really Simple Security' 9.0.0 < 9.1.2 Authentication Bypass	Nessus	CGI abuses	critical
211680	WordPress Plugin 'Really Simple Security Pro' 9.0.0 < 9.1.2 Authentication Bypass	Nessus	CGI abuses	critical
211679	WordPress Plugin 'Really Simple Security Pro Multisite' 9.0.0 < 9.1.2 Authentication Bypass	Nessus	CGI abuses	critical
114512	Really Simple Security Plugin for WordPress 9.x < 9.1.2 Authentication Bypass	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-10924

critical

Tenable Plugins

critical

critical

critical

critical