CVE-2026-89080: Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion

Q: Which accounts are at risk?

Any account using completed email two-factor enrolment may be affected, including administrator accounts. An attacker must already know the targeted account's password.

Q: Can this be exploited without logging in first?

Yes. The affected request is unauthenticated, so the attacker does not need an existing WordPress session or account before attempting the email two-factor enrolment reset.

Q: What versions should be remediated?

Update Really Simple Security to version 9.8.1 or later. Versions before 9.8.1 are affected.

Published Sep 13, 2026

Updated

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

Affected Software

1 affected component

Really Simple Security WordPress plugin<9.8.1

Event History

Sep 13, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which accounts are at risk?

Any account using completed email two-factor enrolment may be affected, including administrator accounts. An attacker must already know the targeted account's password.

Can this be exploited without logging in first?

Yes. The affected request is unauthenticated, so the attacker does not need an existing WordPress session or account before attempting the email two-factor enrolment reset.

What versions should be remediated?

Update Really Simple Security to version 9.8.1 or later. Versions before 9.8.1 are affected.