Log in Start free

Vulnerability · Published Nov 15, 2024 · Assigned by Wordfence

CVE-2024-10924Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

Critical 9.8

In plain English

A critical-severity authentication bypass in Really Simple Security Pro from Really Simple Plugins. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 82.2% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)82.2%top 0.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling3Metasploit, Nuclei, Public PoC

Official description

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

Affected products (as reported)

VendorProductVersions
Really Simple Plugins Really Simple Security Pro multisite 9.0.0 – through 9.1.1.1
rogierlankhorst Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) 9.0.0 – through 9.1.1.1
Really Simple Plugins Really Simple Security Pro 9.0.0 – through 9.1.1.1

Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References