CVE-2026-89080
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment. An attacker who knows the account password can bypass the second factor and obtain the user's session, up to administrator.
Risk Assessment
Bypassing two-factor authentication allows an attacker to take over an account, including administrator accounts, if they know the password. This leads to full site compromise.
Recommendation
Immediately update the Really Simple Security plugin to version 9.8.1 or later. Additionally, force password changes for all privileged accounts.
Other vulnerabilities in Really Simple Security WordPress plugin
Original NVD description (English source)
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS