Skip to content
OpenAdvisories
Critical · 9.8 Scanner template Public exploit CVE-2024-10924 EUVD-2024-33353GHSA-f75h-cwp9-8h5x

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

Published Nov 15, 2024 · Updated Jan 23, 2026 · Assigned by Wordfence

Vendor: Really Simple Plugins Vendor: rogierlankhorst Product: Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) Product: Really Simple Security Pro Product: Really Simple Security Pro multisite

Description

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

Affected products

VendorProductAffectedFixed
Really Simple Plugins Really Simple Security Pro multisite 9.0.0 – ≤ 9.1.1.1 —
rogierlankhorst Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) 9.0.0 – ≤ 9.1.1.1 —
Really Simple Plugins Really Simple Security Pro 9.0.0 – ≤ 9.1.1.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

GitHub 19 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References