CVE-2024-10924: Really Simple Security WordPress plugin authentication bypass via REST API

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network, no-auth, no-interaction exploitation and very high EPSS make this an urgent patch, even though the vulnerable setting is off by default.

What it is

The Really Simple Security plugin for WordPress (Free, Pro, Pro Multisite) versions 9.0.0 to 9.1.1.1 mishandles user check errors in the two-factor REST API 'check_login_and_get_user' function, allowing an authentication bypass. An unauthenticated attacker can log in as any existing user, including an administrator, when the Two-Factor Authentication setting is enabled, which is off by default.

Impact

An attacker gains full account takeover of any user, including administrators, leading to complete site compromise. With admin access they can install plugins, modify content, and execute code on the underlying host.

Attack surface

Reachable over the network through the plugin's two-factor REST API endpoints with no authentication and no user interaction required. The vulnerable path is only active when the Two-Factor Authentication setting is enabled, which is disabled by default.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.82 (99.6th percentile), indicating likely active exploitation. A public GitHub repository referencing a zero-click RCE exploit chain exists, though the record does not confirm weaponization details.

What to do

• Update Really Simple Security (Free, Pro, Pro Multisite) to a version later than 9.1.1.1 immediately.
• If patching is not possible, disable the Two-Factor Authentication setting in the plugin to remove the vulnerable code path.
• Audit WordPress user accounts and sessions for unexpected administrator logins or new accounts.
• Restrict access to the WordPress REST API and admin endpoints at the WAF or reverse proxy where feasible.
• Remove or deactivate the plugin if it is not actively needed.

Detection

• Review WordPress and web server logs for POST requests to the plugin's two-factor REST API routes, especially from unauthenticated or unusual source IPs.
• Monitor for successful logins to administrator accounts that do not match normal user behavior or geography.
• Alert on creation of new admin users, plugin/theme installs, or file changes shortly after suspicious REST API activity.
• Check for the presence of the plugin version 9.0.0 through 9.1.1.1 across all WordPress sites.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.