PT-2026-45694

CVE-2026-8293

Published

2026-06-02

Updated

2026-06-12

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Really Simple Security WordPress plugin versions prior to 9.5.10.1

Description The plugin fails to enforce the second-factor challenge in two of its two-factor authentication REST endpoints. This allows an attacker who possesses a user's password to obtain a WordPress authentication session without completing the email OTP (One-Time Password) challenge.

Recommendations Update the plugin to version 9.5.10.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

John Umoru

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

Related identifiers