Really Simple Security
Approved changes feed: RSS · Atom
cpe:2.3:a:reallysimpleplugins:really_simple_security:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Reallysimpleplugins (7918c6a8-19b5-5e04-aaf8-4f84a32104a9) |
|---|---|
| Product | Really Simple Security (724c5e20-af6c-5f05-b379-a1a23adaeb78) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-82519 |
vulnerable | 2026-09-16 04:32:53.725971 |
Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler
MEDIUM (4.3)
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.
Published: 2026-09-14T19:02:05.279Z
Updated: 2026-09-20T00:35:30.689Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.