An authentication bypass in a plugin installed on about 4 million WordPress sites. Ironically, it affected sites that had turned on two-factor authentication.
Publicly disclosed: 14 November 2024
Really Simple Security (formerly Really Simple SSL) is used to add HTTPS and security features to WordPress. Wordfence found that its two-factor login code did not handle errors correctly: an attacker could log in as any user, including an administrator, without a password. The issue applied when the plugin's two-factor authentication feature was enabled. Forced updates were pushed to sites.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2024-10924 | Critical, CVSS 9.8 (authentication bypass) | Free, Pro and Pro Multisite 9.0.0 – 9.1.1.1 | 9.1.2 and later |
Security plugins are software too — they need updates like everything else.
Sources: Wordfence, NVD CVE-2024-10924.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
