CVE-2026-48970: WordPress Really Simple SSL plugin <= 9.5.10 - Broken Authentication vulnerability

Synopsis

An authentication bypass vulnerability affects the Really Simple SSL WordPress plugin at version 9.5.10 and earlier. The flaw is reachable over the network with no credentials required, though exploitation involves high attack complexity due to environmental or timing constraints. Successful exploitation gives an attacker full read, write, and availability impact on the affected installation. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so the attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by an unauthenticated remote request.

• Victim interactionNot required

  The attacker does not need to trick or wait for any user action to trigger the vulnerability.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for specific environmental conditions, timing constraints, or other factors that are not entirely under their control.

Blast Radius

• A successful attacker can read any data stored in or accessible to the WordPress installation, including user credentials, session tokens, and private content.
• The attacker can write or modify persisted data, including plugin configuration, post content, or user account records.
• The attacker can disrupt service availability, rendering the WordPress site unresponsive or inoperable.