Security Alert Summary
The Really Simple Security WordPress plugin before 9.8.1 contains a flaw that allows an unauthenticated request to reset a user account’s completed email two-factor enrollment. An attacker who already knows a user’s password can use this to bypass the second factor and obtain that user’s session, including accounts with administrator privileges.
CVE Details
- CVE ID: CVE-2026-89080
- Affected plugin: Really Simple Security (WordPress plugin)
- Affected versions: versions before 9.8.1 (example listed: 9.5.10.1 reported as affected)
- Published: September 13, 2026 at 6:16:25 AM UTC
- Last modified: September 13, 2026 at 11:16:59 AM UTC
- CVSS v3.1: base score 7.5, severity HIGH;
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction:
- Authentication: attacker must already know the account password (valid credentials required, per description)
- Privileges required: LOW
- User interaction: NONE
- Primary impacts: Confidentiality: High; Integrity: High; Availability: High
- CWE / weakness: CWE-287 (Improper Authentication)
Technical Details
According to the advisory, the plugin does not prevent an unauthenticated request from resetting an account’s completed email-based two-factor enrollment status. Because the endpoint or action that clears the completed 2FA flag lacks appropriate verification, an attacker who already knows the target account password can bypass the second factor. Successful exploitation results in the attacker obtaining that user’s session, with the advisory noting access can be up to administrator accounts.
No specific functions or REST API endpoints are named in the provided data. The core issue is a missing or insufficient authentication/authorization check around the process that marks email two-factor enrollment as completed, allowing an attacker to revert or clear that state and bypass the second factor when combined with valid credentials.
How This Could Impact Your Website
Consider a scenario with a site owner, internal staff member, and an external contractor. If an attacker knows the contractor’s password (for example, from a reused password on another service), the attacker could reset that contractor’s completed email two-factor enrollment and sign in without the second factor. If the contractor has elevated privileges or access to administrative workflows, the attacker could act with those privileges during the hijacked session.
Practical consequences include exposure of internal user email addresses and accounts being accessed without the second factor, increasing the risk of targeted phishing or social engineering against staff and administrators. This is particularly concerning when users share passwords or when contributors have more privileges than necessary.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts that may have access to sensitive functionality.
- Enforce strong, unique passwords and enable two-factor authentication for editor and administrator accounts wherever possible.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual authentication attempts or session creation behavior.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
