Vulnerability

CERT-In Vulnerability Note CIVN-2024-0344
Really Simple Security plugin Authentication Bypass Vulnerability

Original Issue Date:November 22, 2024

Severity Rating: CRITICAL

Software Affected

Really Simple Security (Free, Pro and Multisite) versions 9.0.0 to 9.1.1.1

Overview

A vulnerability has been reported in Really Simple Security plugin for WordPress which could allow a remote attacker to gain full administrative access to a site running the plugin.

Target Audience:
All end-users/Administrators of WordPress sites running Really Simple Security plugin.

Risk Assessment:
Critical risk of unauthorized access to sensitive data, data breaches.

Impact Assessment:
Potential impact on confidentiality, integrity, and availability of the system.

Description

Really Simple Security is a security plugin for the WordPress platform, offering SSL configuration, login protection, two-factor authentication layer and real-time vulnerability detection.

This vulnerability exists in Really Simple Security plugin for WordPress due to improper user check error handling in the two-factor REST API actions with the "check_login_and_get_user function".

Successful exploitation of this vulnerability could allow an unauthenticated attacker to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

Solution

Update the plugin to version 9.1.2 or later

https://www.wordfence.com/threat-intel/vulnerabilities/detail/really-simple-security-free-pro-and-pro-multisite-900-9111-authentication-bypass

Vendor Information

Wordfence
https://www.wordfence.com/threat-intel/vulnerabilities/detail/really-simple-security-free-pro-and-pro-multisite-900-9111-authentication-bypass

References

Wordfence
https://www.wordfence.com/threat-intel/vulnerabilities/detail/really-simple-security-free-pro-and-pro-multisite-900-9111-authentication-bypass

CVE Name
CVE-2024-10924

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India