{"id":"CVE-2026-8293","aliases":["EUVD-2026-33882","GHSA-g33r-3vq8-q6f4"],"status":"published","title":"Really Simple Security \u003c 9.5.10.1 - Authentication Bypass via Two-Factor OTP Skip","description":"The Really Simple Security  WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00236,"percentile":0.14712,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-06-02T06:00:02Z","modified":"2026-07-22T19:10:00Z","products":[{"vendor":"unknown","product":"really simple security"}],"references":[{"url":"https://wpscan.com/vulnerability/1de69ef9-6226-4292-8e36-b331a37f043e/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8293"},{"url":"https://wpscan.com/vulnerability/1de69ef9-6226-4292-8e36-b331a37f043e"},{"url":"https://github.com/advisories/GHSA-g33r-3vq8-q6f4"}],"sources":{"cve":[{"id":"CVE-2026-8293","title":"Really Simple Security \u003c 9.5.10.1 - Authentication Bypass via Two-Factor OTP Skip","description":"The Really Simple Security  WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.","status":"published","published":"2026-06-02T06:00:02.468Z","modified":"2026-06-02T10:39:15.547Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-33882","description":"The Really Simple Security  WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.","status":"published","published":"2026-06-02T06:00:02Z","modified":"2026-06-02T10:39:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:56.977213Z"}],"ghsa":[{"id":"GHSA-g33r-3vq8-q6f4","title":"The Really Simple Security  WordPress plugin before 9.5.10.1 does not enforce the second-factor...","description":"The Really Simple Security  WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.","status":"published","published":"2026-06-02T09:36:14Z","modified":"2026-06-02T12:32:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:08:29.586291Z"}],"nvd":[{"id":"CVE-2026-8293","description":"The Really Simple Security  WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.","status":"published","published":"2026-06-02T07:16:13.707Z","modified":"2026-07-22T19:10:00.12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:22.022466Z"}]}}