CVE-2026-8293: Really Simple Security WordPress Plugin 2FA Authentication Bypass

Executive Summary

A high-severity authentication bypass vulnerability (CVE-2026-8293) has been discovered in the Really Simple Security WordPress plugin (formerly Really Simple SSL), affecting all versions prior to 9.5.10.1. The vulnerability carries a CVSS score of 7.5.

The flaw allows an attacker who already knows a valid user's password to completely bypass the plugin's two-factor authentication (2FA) enforcement. Two specific REST API endpoints fail to require completion of the email OTP second factor, meaning an attacker can authenticate as that user without ever receiving or entering the 2FA code.

This is particularly dangerous because Really Simple Security is one of the most widely installed WordPress security plugins, with millions of active installations. Sites using 2FA as a key security control may be unknowingly exposed.

Vulnerability Overview

Affected Versions

Technical Analysis

Root Cause

The Really Simple Security plugin offers two-factor authentication via email OTP as part of its security suite. After a user successfully enters their password, the plugin is supposed to require completion of the email OTP challenge before granting an authenticated WordPress session.

The vulnerability exists because two specific REST API authentication endpoints do not enforce the second-factor challenge. The plugin's REST API flow allows the authentication state to advance past the 2FA gate without verifying that the OTP step was completed.

An attacker who has obtained a valid username and password (via phishing, credential stuffing, or password reuse) can target these REST API endpoints directly, bypassing the 2FA check entirely and obtaining a fully authenticated WordPress session.

Attack Flow

1. Attacker obtains valid username + password (phishing, credential stuffing, leaked credentials)
2. Attacker identifies the target site uses Really Simple Security < 9.5.10.1 with 2FA enabled
3. Attacker sends authentication request directly to the unguarded REST API endpoint:
   POST /wp-json/reallysimplessl/v1/[endpoint]
   { "username": "admin", "password": "validpass" }
4. Endpoint processes credentials and returns a valid authentication session
5. 2FA email OTP challenge is never triggered or required
6. Attacker receives a valid WordPress session cookie — full account access granted
7. Site 2FA protections are effectively neutralized

Why This Is Significant

Many site administrators specifically deploy Really Simple Security because of its 2FA feature, believing it protects against credential theft scenarios. This vulnerability defeats that protection entirely: any stolen or leaked credential set is sufficient for full account takeover on affected sites, even with 2FA ostensibly enabled.

Impact Assessment

Immediate Remediation

Step 1: Update Really Simple Security to 9.5.10.1

# Check current version
wp plugin get really-simple-ssl --field=version
 
# Update to patched version
wp plugin update really-simple-ssl
 
# Verify updated version
wp plugin get really-simple-ssl --field=version
# Expected: 9.5.10.1 or higher

Or navigate to WordPress Admin → Plugins → Really Simple Security → Update Now.

Step 2: Verify 2FA Is Functioning Post-Update

After updating, test the 2FA flow manually:

1. Log out of WordPress
2. Attempt login with valid credentials
3. Verify the email OTP challenge is presented before granting access
4. Confirm the session is only established after OTP entry

Step 3: Audit for Compromise

# Review recent authentication events (if audit logging is active)
wp db query "SELECT user_login, user_email, user_registered FROM wp_users ORDER BY user_registered DESC LIMIT 20;"
 
# Check for recently created accounts
wp user list --fields=user_login,user_email,roles,user_registered
 
# Check for new admin-level accounts
wp user list --role=administrator
 
# Scan for modified files indicating post-compromise activity
find /var/www/html/wp-content/ -name "*.php" -newer /var/www/html/wp-includes/version.php -type f

Step 4: Rotate Credentials and Sessions

# Force password resets for administrators
wp user list --role=administrator --format=ids | xargs -I {} wp user update {} --user_pass="$(openssl rand -base64 24)"
 
# Invalidate all active sessions
wp db query "DELETE FROM wp_usermeta WHERE meta_key = 'session_tokens';"
 
# Regenerate WordPress secret keys
wp config shuffle-salts

Detection Indicators

Post-Remediation Checklist

1. Update Really Simple Security to version 9.5.10.1 or later
2. Test the 2FA flow post-update to confirm the OTP challenge is enforced
3. Audit all administrator and editor accounts for unauthorized entries
4. Reset admin passwords and regenerate WordPress secret keys
5. Invalidate all active sessions
6. Review access logs for signs of prior REST API exploitation
7. Enable login attempt logging if not already active (Really Simple Security includes this)
8. Consider IP-restricting the WordPress admin area (/wp-admin/, /wp-login.php/) via .htaccess or a WAF

References

• NVD — CVE-2026-8293
• Really Simple Security Plugin — WordPress Repository