CVE-2024-10924: Really Simple Security Auth Bypass Flaw

CVE-2024-10924 Overview

CVE-2024-10924 is an authentication bypass vulnerability in the Really Simple Security plugin for WordPress, affecting Free, Pro, and Pro Multisite editions versions 9.0.0 through 9.1.1.1. The flaw resides in the two-factor REST API actions, where the check_login_and_get_user function performs improper user check error handling. Unauthenticated attackers can exploit this weakness to log in as any existing user, including administrators, when the Two-Factor Authentication setting is enabled. The plugin is installed on more than four million WordPress sites, making this one of the largest WordPress security exposures of 2024.

Critical Impact

Remote unauthenticated attackers can authenticate as any WordPress administrator on vulnerable sites with 2FA enabled, leading to full site takeover.

Affected Products

• Really Simple Security (Free) for WordPress versions 9.0.0 to 9.1.1.1
• Really Simple Security Pro for WordPress versions 9.0.0 to 9.1.1.1
• Really Simple Security Pro Multisite for WordPress versions 9.0.0 to 9.1.1.1

Discovery Timeline

• 2024-11-15 - CVE-2024-10924 published to NVD
• 2026-01-23 - Last updated in NVD database

Technical Details for CVE-2024-10924

Vulnerability Analysis

The vulnerability is classified under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel) and [CWE-306] (Missing Authentication for a Critical Function). It exists in the two-factor onboarding REST API code shipped with the plugin, specifically in class-rsssl-two-factor-on-board-api.php. The check_login_and_get_user function returns user objects without properly distinguishing between successful authentication and error states. When a request triggers the error branch, downstream code still treats the response as a valid authenticated user. An attacker submitting a crafted REST request to the two-factor verification endpoint can supply a target user_id and receive a valid session as that user.

The issue only manifests when the Two-Factor Authentication feature is enabled in the plugin. While 2FA is disabled by default, administrators who enabled it for stronger security ironically exposed their sites to complete authentication bypass.

Root Cause

The root cause is improper error handling in the user validation path. Lines 67, 277, and 278 of class-rsssl-two-factor-on-board-api.php retrieve a user object but fail to verify whether the returned value represents a WP_Error or an authenticated user. The REST endpoint then sets authentication cookies based on the attacker-supplied identifier without verifying credentials or one-time codes.

Attack Vector

Exploitation requires only network access to the WordPress site's REST API. The attacker sends an HTTP POST request to the vulnerable two-factor REST route with parameters identifying the target user account. No credentials, tokens, or user interaction are required. Public proof-of-concept exploits are available, including a GitHub PoC repository and a zero-click RCE chain that leverages administrator access to achieve remote code execution through plugin or theme upload. The EPSS probability of 93.889% (99.878 percentile) indicates active exploitation interest.

For technical specifics, see the Wordfence vulnerability analysis and the upstream code review of the vulnerable function.

Detection Methods for CVE-2024-10924

Indicators of Compromise

• HTTP requests to /wp-json/reallysimplessl/v1/two_fa/skip_onboarding or related reallysimplessl/v1/two_fa/ REST routes from unauthenticated sources.
• Unexpected administrator logins in wp_users activity or audit logs without a corresponding successful password authentication event.
• Newly created administrator accounts, plugin installations, or theme uploads following suspicious REST API traffic.
• Outbound connections from the WordPress host to attacker-controlled infrastructure shortly after REST API access.

Detection Strategies

• Inspect web server access logs for POST requests targeting reallysimplessl/v1/two_fa/ endpoints with user_id or login_nonce parameters from anonymous clients.
• Correlate WordPress authentication events with web requests to identify sessions established without prior wp-login.php activity.
• Deploy WordPress security plugins or web application firewall (WAF) rules that detect the published exploit signatures for CVE-2024-10924.

Monitoring Recommendations

• Enable verbose REST API request logging and forward logs to a centralized SIEM for correlation and retention.
• Alert on changes to administrator role membership, new plugin uploads, and modifications to core WordPress files.
• Monitor for the Really Simple Security plugin version through automated asset inventory to confirm all instances are patched above 9.1.2.

How to Mitigate CVE-2024-10924

Immediate Actions Required

• Update Really Simple Security (Free, Pro, and Pro Multisite) to version 9.1.2 or later immediately on all WordPress installations.
• Audit administrator accounts and recently installed plugins or themes for unauthorized changes.
• Rotate WordPress administrator passwords and invalidate all active sessions after patching.
• Review web server and REST API logs for prior exploitation attempts dating back to the plugin upgrade to 9.0.0.

Patch Information

The vendor released a fix in version 9.1.2 of Really Simple Security. WordPress.org and the plugin developer initiated a forced auto-update for affected sites because of the scope of the vulnerability. Review the corrected code in WordPress Change Set 3188431. Confirm the installed version is at minimum 9.1.2 across all WordPress sites, including staging and multisite networks.

Workarounds

• Disable the Two-Factor Authentication setting within Really Simple Security if immediate patching is not possible, since the bypass only triggers when 2FA is enabled.
• Temporarily deactivate the Really Simple Security plugin until version 9.1.2 or later can be installed.
• Block external access to the /wp-json/reallysimplessl/ REST namespace at the WAF or reverse proxy layer.

# Update Really Simple Security via WP-CLI on the affected WordPress host
wp plugin update really-simple-ssl --version=9.1.2

# Verify the installed version
wp plugin get really-simple-ssl --field=version

# Optional: disable the plugin until patch is applied
wp plugin deactivate really-simple-ssl