Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck
CVE-2026-82519Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler
Medium 4.3
In plain English
A medium-severity missing authorization in Really Simple Security from reallysimpleplugins. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| reallysimpleplugins | Really Simple Security | 0 – before 9.8.2 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N