CVE-2026-89080

Name of the Vulnerable Software and Affected Versions Really Simple Security versions prior to 9.8.1

Description The plugin fails to prevent unauthenticated requests from resetting a completed email two-factor enrolment for an account. This allows an attacker who possesses the account password to bypass the second factor of authentication and obtain a user session, which could potentially grant administrator privileges.

Recommendations Update to version 9.8.1 or later.