CVE-2026-89080 — Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing …
Published: 2026-09-13 · CVSS: 7.5 · CVSS 3.1
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7