Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-20
Really Simple Ssl - Security Vulnerability (CVE-2026-82519)
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.
PLUGIN
Really Simple Ssl
CVE-2026-82519
Risk Score
Threat Entry
Updated 2026-09-03
Really Simple Ssl - Security Vulnerability (CVE-2026-84777)
Unauthenticated Broken Authentication in Really Simple SSL
PLUGIN
Really Simple Ssl
CVE-2026-84777
Risk Score
Threat Entry
Updated 2026-09-02
Really Simple SSL - Denial of Service (CVE-2026-84775)
Unauthenticated Denial of Service Attack in Really Simple SSL
PLUGIN
Really Simple SSL
CVE-2026-84775
Risk Score
Threat Entry
Updated 2026-06-17
Really Simple Ssl - Security Vulnerability (CVE-2026-48970)
Unauthenticated Broken Authentication in Really Simple SSL
PLUGIN
Really Simple Ssl
CVE-2026-48970
Risk Score
Threat Entry
Updated 2026-06-17
Really Simple SSL - Broken Access Control (CVE-2026-48969)
Subscriber Broken Access Control in Really Simple SSL
PLUGIN
Really Simple SSL
CVE-2026-48969
Risk Score
Threat Entry
Updated 2026-06-17
Really Simple Ssl - Broken Access Control (CVE-2026-32461)
Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple SSL: from n/a through
PLUGIN
Really Simple Ssl
CVE-2026-32461
Risk Score
Threat Entry
Updated 2026-06-17
Really Simple Ssl - Cross-Site Request Forgery (CSRF) (CVE-2025-24623)
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Cross Site Request Forgery.This issue affects Really Simple SSL: from n/a through
PLUGIN
Really Simple Ssl
CVE-2025-24623
Risk Score
Threat Entry
Updated 2026-06-17
Really Simple Ssl - Authentication Bypass (CVE-2024-10924)
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
PLUGIN
Really Simple Ssl
CVE-2024-10924
Risk Score