A critical authentication bypass vulnerability in the Really Simple Security plugin allows attackers to circumvent two-factor authentication, posing a severe risk of full administrative account takeover.

This vulnerability, categorized under CWE-287, involves an improper authentication check where an unauthenticated request can reset the email-based two-factor enrollment. By targeting the two-factor mechanism, an attacker who has already obtained a user's password can bypass the secondary authentication layer to hijack active sessions, including those with administrative privileges.

The ability for an unauthorized party to bypass multi-factor authentication and compromise administrative accounts represents a critical business risk. A successful exploit can lead to full site takeover, unauthorized data exfiltration, and the installation of malicious payloads, causing significant reputational damage and operational disruption. With a CVSS score of 7.5, this vulnerability is classified as high severity, particularly given the potential for total system compromise.

Immediate Action: Update the Really Simple Security plugin to version 9.8.1 or later immediately to apply the patch provided by the vendor.

Proactive Monitoring: Review WordPress user authentication logs and monitor for anomalous account modifications, specifically looking for unexpected resets of security settings or two-factor authentication profiles.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests targeting known plugin endpoints or suspicious patterns related to authentication resets.

Public Exploit Available: Unknown

Security teams should prioritize the update of the Really Simple Security plugin across all WordPress instances. Given that this flaw permits complete account takeover, failing to patch exposes the organization to severe unauthorized access risks. Immediate verification of plugin versions and the application of the vendor-supplied fix are essential to maintaining the integrity of the authentication chain.