Two-Factor Authentication Bypass in Really Simple Security Plugin for WordPress
CVE-2026-89080
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 13 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-89080?
The Really Simple Security plugin for WordPress, prior to version 9.8.1, contains a vulnerability that permits unauthorized requests to reset a user account's completed email two-factor enrollment. An attacker with knowledge of the account's password can exploit this flaw to bypass the second authentication factor, potentially allowing access to user sessions, including those with administrative privileges.
Affected Version(s)
Really Simple Security 9.5.10.1 < 9.8.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.