CVE-2026-82519Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler
Updated under an hour ago ()
Does this affect you?
It affects reallysimpleplugins Really Simple Security. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.
- CVSS
- 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-862
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Sep 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
reallysimpleplugins Really Simple Security reallysimpleplugins:really_simple_security (from the name) | before 9.8.2 | CNA record |
References
- https://wordpress.org/plugins/really-simple-ssl/#developers
- https://www.vulncheck.com/advisories/really-simple-security-authorization-bypass-via-profile-page-update-handlerthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.