CVE-2026-82519: Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger deletetwofameta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Really Simple Security (WordPress)to a version that resolves this vulnerability.Fixed in 9.8.2 - Compensating control
Apply compensating access control by restricting who can access the Really Simple Security profile-page update handler so low-privileged authenticated users cannot reach the missing authorization check code path until the plugin is upgraded to 9.8.2.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated with a low-privileged account. The attack can be performed remotely and does not require user interaction.
What does an attacker need to do to bypass 2FA enforcement?
They need to submit a crafted POST request to the profile-page update handler that omits the two-factor-authentication field. This follows an unguarded path that skips nonce verification and resets the 2FA grace-period anchor timestamp.
What is the practical impact on affected accounts?
Mandatory two-factor authentication can be deferred indefinitely for the attacking authenticated account. The attacker can reset the grace-period timing on each login cycle rather than completing enforced 2FA.
Which versions are affected?
Really Simple Security versions before 9.8.2 are affected. Updating to version 9.8.2 or later addresses the issue.