PT-2026-45694 · WordPress · Really Simple Security

John Umoru · CVE-2026-8293 · Published 2026-06-02 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Really Simple Security WordPress plugin versions prior to 9.5.10.1

Description The plugin fails to enforce the second-factor challenge in two of its two-factor authentication REST endpoints. This allows an attacker who possesses a user's password to obtain a WordPress authentication session without completing the email OTP (One-Time Password) challenge.

Recommendations Update the plugin to version 9.5.10.1 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-8293

Affected Products

Really Simple Security

References · 3

• 🔥 https://wpscan.com/vulnerability/1de69ef9-6226-4292-8e36-b331a37f043e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8293 · Security Note
• https://t.me/cveNotify/165615 · Telegram Post