NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST CWE-306

OR
     *cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:-:wordpress:*:* versions from (including) 9.0.0 up to (excluding) 9.1.2
     *cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro:wordpress:*:* versions from (including) 9.0.0 up to (excluding) 9.1.2
     *cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro_multisite:wordpress:*:* versions from (including) 9.0.0 up to (excluding) 9.1.2

https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277 No Types Assigned

https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277 Product

https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278 No Types Assigned

https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278 Product

https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67 No Types Assigned

https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67 Product

https://plugins.trac.wordpress.org/changeset/3188431/really-simple-ssl No Types Assigned

https://plugins.trac.wordpress.org/changeset/3188431/really-simple-ssl Patch

https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/ No Types Assigned

https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/ Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5d05ad-1a7a-43d2-bbbf-597e975446be?source=cve No Types Assigned

https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5d05ad-1a7a-43d2-bbbf-597e975446be?source=cve Third Party Advisory

Wordfence https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/ [No types assigned]

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

Wordfence AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Wordfence CWE-288

Wordfence https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277 [No types assigned]

Wordfence https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278 [No types assigned]

Wordfence https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67 [No types assigned]

Wordfence https://plugins.trac.wordpress.org/changeset/3188431/really-simple-ssl [No types assigned]

Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5d05ad-1a7a-43d2-bbbf-597e975446be?source=cve [No types assigned]