CVE-2026-8293
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session without completing the email OTP challenge.
Risk Assessment
An attacker who knows a user's password can bypass two-factor authentication and gain access to the account, potentially leading to WordPress site takeover.
Recommendation
Update the Really Simple Security plugin to version 9.5.10.1 or later.
Other vulnerabilities in Really Simple Security WordPress plugin
Original NVD description (English source)
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS