Bypassing Two-Factor Authentication in Really Simple Security Plugin for WordPress
CVE-2026-8293
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 2 June 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-8293?
The Really Simple Security plugin for WordPress, prior to version 9.5.10.1, inadequately implements the second-factor authentication challenge in its REST endpoints. This flaw allows attackers who have compromised a user's password to bypass the email OTP requirement, enabling them to gain unauthorized access to the user's WordPress session without entering the one-time password. Securing this plugin is essential to maintain robust user authentication and prevent unauthorized access.
Affected Version(s)
Really Simple Security 0 < 9.5.10.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.