Vulnerability details
CVE-2024-10924
reallysimpleplugins Really Simple Securityreallysimpleplugins Really Simple Security Proreallysimpleplugins Really Simple Security Pro multisiterogierlankhorst Really Simple Security – Simple and Performant Security
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
CVSS 3.1
9.8Critical
Official description
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (Wordfence) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| reallysimpleplugins | Really Simple Security | 9.0.0 ≤ v ≤ 9.1.1.1 | CISA ADP / Vulnrichment |
| reallysimpleplugins | Really Simple Security Pro | 9.0.0 ≤ v ≤ 9.1.1.1 | CVEProject cvelistV5 (CNA) |
| reallysimpleplugins | Really Simple Security Pro multisite | 9.0.0 ≤ v ≤ 9.1.1.1 | CVEProject cvelistV5 (CNA) |
| rogierlankhorst | Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | 9.0.0 ≤ v ≤ 9.1.1.1 | CVEProject cvelistV5 (CNA) |
References and advisories
7- https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5d05ad-1a7a-43d2-bbbf-597e975446be?source=cve
- https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67
- https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277
- https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278
- https://plugins.trac.wordpress.org/changeset/3188431/really-simple-ssl
- https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/
- https://github.com/JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-10924
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2024-11-15
- Last updated
- 2026-01-23
- State
- Published
- Assigner (CNA)
- Wordfence
- Kolun priority
- 40 · Medium
Exploit prediction (EPSS)
82.21%
Probability of exploitation in 30 days
99.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-288Authentication Bypass Using an Alternate Path or Channel