CVE-2024-10924 in the critical feed json
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
published 2024-11-15 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-33353
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 82.2%
- EPSS 82.2% chance of exploitation in 30 days, percentile 99.6%
- public exploits
- 2
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
Patch / fix
- really-simple-plugins really_simple_security 9.1.2
Timeline
- First public exploit (Metasploit exploit/multi/http/wp_reallysimplessl_2fa_bypass_rce)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction
82.22% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/wp_reallysimplessl_2fa_bypass_rce WordPress Really Simple SSL Plugin Authentication Bypass to RCE metasploit exploit, excellent rank, 2024-11-14
- EDB-52207 Really Simple Security 9.1.1.1 - Authentication Bypass webapps, 2025-04-15
- Nuclei template Really Simple Security < 9.1.2 - Authentication Bypass nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Really Simple Plugins Really Simple Security Pro multisite
- rogierlankhorst Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
- Really Simple Plugins Really Simple Security Pro
- really-simple-plugins really_simple_security
Classification
- Weakness
- Technology feeds
References
-
plugins.trac.wordpress.org
/changeset/3188431/really-simple-ssl
patch
-
wordfence.com
/threat-intel/vulnerabilities/id/7d5d05ad-1a7a-43d2-bbbf-597e975446be?source=cve
third-party-advisory
-
plugins.trac.wordpress.org
/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67
product
-
plugins.trac.wordpress.org
/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277
product
-
plugins.trac.wordpress.org
/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278
product
-
wordfence.com
/blog/2024/11/really-simple-security-vulnerability/
third-party-advisory
- github.com /JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-10924
Sources
- CVE List CVE-2024-10924
- NVD CVE-2024-10924
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.