What’s Vulnerable › Vulnerabilities
CVE-2026-89080: Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-13 · updated 2026-09-14
- Weakness: CWE-287
Description
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
Affected products
- Really Simple Security: from 9.5.10.1 before 9.8.1 — fixed in 9.8.1
How to fix
Upgrade to a fixed version: Really Simple Security 9.8.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-89080 or the next vulnerability affects your stack