CVE-2026-89080

Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

Affected

Really Simple Security

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.34% chance of exploitation in the next 30 days, 26th percentile

Published

2026-09-13

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/49546064-5663-40f8-be7c-4f3faa31fa9a/

References

• CVE Record
• NVD entry