A critical authentication bypass vulnerability has been revealed in the Really Simple Security plugin for WordPress, formerly known as Really Simple SSL. This vulnerability, identified as CVE-2024-10924 with a CVSS score of 9.8, affects both the free and premium versions of the plugin, which is utilized on over 4 million WordPress websites.
The security flaw allows an attacker to remotely gain full administrative access to a vulnerable site. According to Wordfence security researcher István Márton, the vulnerability is scriptable, making it possible for automated attacks to target WordPress websites.
After responsible disclosure on November 6, 2024, the vulnerability was patched in version 9.1.2 released a week later. To mitigate the risk of exploitation, the plugin maintainers are working with WordPress to force-update all sites running this plugin before public disclosure.
The vulnerability, present in versions 9.0.0 to 9.1.1.1, arises from an error in user check handling in the “check_login_and_get_user” function. This flaw allows unauthenticated attackers to log in as any user, including administrators, especially when two-factor authentication is enabled.
Exploiting this vulnerability could have severe consequences, as it could enable malicious actors to take control of WordPress sites for nefarious purposes. This disclosure comes shortly after Wordfence identified another critical vulnerability in the WPLMS Learning Management System for WordPress, highlighting the importance of timely security updates and patches to safeguard websites from potential threats.
Source link
