Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-18
Really Simple Security - Security Vulnerability (CVE-2026-88798)
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
PLUGIN
Really Simple Security
CVE-2026-88798
Risk Score
Threat Entry
Updated 2026-09-20
Really Simple Security - Security Vulnerability (CVE-2026-82519)
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.
PLUGIN
Really Simple Security
CVE-2026-82519
Risk Score
Threat Entry
Updated 2026-09-14
Really Simple Security - Security Vulnerability (CVE-2026-89080)
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
PLUGIN
Really Simple Security
CVE-2026-89080
Risk Score
Threat Entry
Updated 2026-08-31
Really Simple Security - Security Vulnerability (CVE-2026-81766)
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared Really Simple Security WordPress plugin before 9.8.0 directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Really Simple Security WordPress plugin before 9.8.0 administration menu for subsites, which is not…
PLUGIN
Really Simple Security
CVE-2026-81766
Risk Score
Threat Entry
Updated 2026-07-22
Really Simple Security - Security Vulnerability (CVE-2026-8293)
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.
PLUGIN
Really Simple Security
CVE-2026-8293
Risk Score
Threat Entry
Updated 2026-06-17
Really Simple Security - Authentication Bypass (CVE-2024-10924)
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
PLUGIN
Really Simple Security
CVE-2024-10924
Risk Score