https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:34:24.769549+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-09749 bdu:2024-09749 2026-10-04T00:34:24.878366+00:00 bdu:2024-09749 https://cve.radiocsirt.org/vuln/euvd-2026-266417 EUVD-2026-266417 2026-10-04T00:34:24.878400+00:00 EUVD-2026-266417 https://cve.radiocsirt.org/vuln/fkie_cve-2024-10924 fkie_cve-2024-10924 2026-10-04T00:34:24.878414+00:00

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

 https://cve.radiocsirt.org/vuln/ghsa-f75h-cwp9-8h5x GHSA-f75h-cwp9-8h5x 2026-10-04T00:34:24.878446+00:00

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).