CVE-2026-89080: Really Simple Security Auth Bypass Flaw

CVE-2026-89080 Overview

CVE-2026-89080 is an authentication flaw in the Really Simple Security WordPress plugin before version 9.8.1. The plugin fails to prevent an unauthenticated request from resetting an account's completed email two-factor authentication (2FA) enrolment. An attacker who already possesses a valid username and password can trigger this reset and bypass the second factor, gaining access to the associated user session. When the target account holds administrator privileges, the attacker obtains full control of the affected WordPress site. The weakness is classified under [CWE-287] Improper Authentication.

Critical Impact
Attackers with knowledge of a WordPress account's password can bypass email-based 2FA and hijack sessions up to administrator level on sites running Really Simple Security below 9.8.1.

Affected Products

Really Simple Security WordPress plugin versions prior to 9.8.1
WordPress sites using email-based two-factor authentication provided by Really Simple Security
Administrator and standard user accounts protected by the plugin's 2FA feature

Discovery Timeline

2026-09-13 - CVE-2026-89080 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89080

Vulnerability Analysis

The Really Simple Security plugin enforces a second authentication factor by requiring users to confirm a code delivered via email. Once a user completes enrolment, the plugin stores state that marks 2FA as active for that account. The vulnerability exists in the endpoint that handles resetting or re-enrolling the email second factor. The plugin accepts this reset request without requiring an authenticated session or verifying the requester. As a result, an unauthenticated attacker can clear the 2FA enrolment on a targeted account. After the reset, the account behaves as if 2FA was never configured, and password-only login yields a full session.

Root Cause

The root cause is a missing authentication and authorization check on the 2FA reset code path [CWE-287]. The plugin relied on the presence of the second factor as an implicit access control, but exposed a mechanism to disable that factor without validating the caller. Password possession alone becomes sufficient to reach the authenticated session.

Attack Vector

Exploitation is network-based and requires the attacker to already know a valid password for the target account. Credentials can be obtained through prior breaches, credential stuffing, phishing, or password reuse. The attacker sends an unauthenticated HTTP request to the vulnerable reset endpoint to invalidate the target's email 2FA enrolment. The attacker then authenticates with the known password and, because 2FA no longer applies, receives a session cookie. If the compromised account is an administrator, the attacker inherits full control of the WordPress installation. Technical specifics for the vulnerable endpoint are documented in the WPScan Vulnerability Advisory.

Detection Methods for CVE-2026-89080

Indicators of Compromise

Unauthenticated HTTP POST requests to Really Simple Security 2FA reset or re-enrolment endpoints under /wp-json/ or /wp-admin/admin-ajax.php
Successful administrator logins immediately following a 2FA reset event for the same account
Changes to WordPress user metadata related to rsssl_two_fa_status or equivalent 2FA enrolment fields without an authenticated session preceding them
New administrator accounts, plugin installations, or theme file modifications after a suspicious login

Detection Strategies

Enable WordPress audit logging and alert on 2FA state transitions from active to disabled or pending
Correlate web server access logs for requests to Really Simple Security REST routes lacking a valid wordpress_logged_in_* cookie or nonce
Flag authentication events where the same account completes 2FA enrolment, resets it, and re-authenticates within a short time window
Monitor for HTTP requests originating from IP addresses that have not previously interacted with /wp-login.php for the targeted user

Monitoring Recommendations

Forward WordPress, plugin, and web server logs to a centralized logging platform for correlation and retention
Baseline normal 2FA enrolment activity per account and alert on deviations
Track administrator session creation events and validate against expected user activity windows
Review Really Simple Security plugin version inventory across all managed WordPress sites to identify hosts still running versions below 9.8.1

How to Mitigate CVE-2026-89080

Immediate Actions Required

Upgrade the Really Simple Security plugin to version 9.8.1 or later on every WordPress site in the environment
Force a password reset for all users, especially administrators, on sites that ran vulnerable versions
Invalidate active sessions by rotating WordPress authentication keys and salts in wp-config.php
Audit user accounts for unauthorized administrator additions and unexpected plugin or theme changes

Patch Information

The vendor addressed CVE-2026-89080 in Really Simple Security version 9.8.1 by requiring proper authentication before the 2FA reset flow can execute. Site operators should apply the update through the WordPress plugin manager or WP-CLI. Refer to the WPScan Vulnerability Advisory for the disclosed technical scope.

Workarounds

Restrict access to /wp-admin/ and /wp-json/ at the web server or WAF layer to trusted IP ranges until the patch is applied
Deploy a WAF rule that blocks unauthenticated requests to Really Simple Security 2FA reset endpoints
Temporarily disable the Really Simple Security plugin on high-value sites if patching cannot be performed immediately, and rely on an alternative 2FA provider
Enforce unique, high-entropy passwords and monitor for credential stuffing attempts against /wp-login.php

bash

# Update Really Simple Security via WP-CLI
wp plugin update really-simple-ssl --version=9.8.1

# Verify installed version
wp plugin get really-simple-ssl --field=version

# Rotate authentication keys and salts to invalidate sessions
wp config shuffle-salts