WordPress Security Snafu: ‘Really Simple Security’ Plugin Vulnerability Exposes Millions
A critical authentication bypass vulnerability in the WordPress plugin Really Simple Security has been discovered, impacting both free and Pro versions. This flaw allows remote attackers to gain full administrative access to affected sites. Wordfence warns it’s one of the most severe vulnerabilities in their 12-year history. Update to version 9.1.2 now!
Hot Take:
In a plot twist worthy of a cybersecurity thriller, the very plugin meant to protect your WordPress site is now its biggest threat. It’s like hiring a bodyguard who moonlights as a burglar. Who knew two-factor authentication could lead to a two-factor invasion?
Key Points:
- A vulnerability in the ‘Really Simple Security’ plugin allows full administrative access to attackers.
- The flaw is due to mishandling of authentication in the two-factor REST API.
- This vulnerability can be exploited en masse via automated scripts.
- Wordfence recommends force updates by hosting providers to mitigate risk.
- The issue impacts plugin versions from 9.0.0 to 9.1.1.1, with fixes applied in version 9.1.2.
Already a member? Log in here