CVE-2026-8293: Really Simple Security < 9.5.10.1 - Authentication Bypass via Two-Factor OTP Skip

Synopsis

Authentication bypass in the Really Simple Security WordPress plugin (versions before 9.5.10.1) allows an attacker who already knows a user's password to skip the email one-time-password step entirely by sending crafted requests to two unprotected REST API endpoints. The attack is reachable over the network, requires a low-privilege account (at minimum, a valid username and password), and needs no victim interaction. Successful exploitation gives the attacker a full WordPress authentication session, enabling complete read, write, and availability impact on the target site. A patched-image rebuild at version 9.5.10.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress REST API over the network; the two vulnerable endpoints are externally accessible on any standard WordPress installation.

• AuthenticationRequired

  The attacker must possess a valid username and password for an existing WordPress account; any low-privilege account credential is sufficient to trigger the bypass.

• Victim interactionNot required

  No victim action is needed; the attacker sends crafted REST API requests directly without requiring any user to click a link or take any other step.

• Attack complexityDetail

  Attack complexity is rated High, meaning reliable exploitation may depend on environmental factors such as timing or specific server configuration, rather than being a fully condition-free exploit.

Blast Radius

• Attacker obtains a valid WordPress session cookie for the targeted user account, gaining the same site access as that user.
• If the compromised account holds editor, administrator, or other elevated roles, the attacker can read all stored posts, pages, user data, and plugin configuration including API keys or credentials stored in site options.
• The attacker can modify or delete posts, pages, user accounts, and site settings, corrupting content or escalating to full site takeover by installing a malicious plugin.
• Administrative access enables the attacker to make the site unavailable by deleting core configuration, deactivating plugins, or injecting code that crashes PHP execution.