CVE-2026-82519

Katalog CVE

CVSS 4.3 · Medium EPSS 0,36%

Kerentanan Missing Authorization. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.

Rincian

Terbit di NVD

14 September 2026

Terakhir diubah

20 September 2026

Status NVD

Deferred

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://wordpress.org/plugins/really-simple-ssl/#developers
• https://www.vulncheck.com/advisories/really-simple-security-authorization-bypass-via-profile-page-update-handl...