Really Simple Security: Authentication Bypass (CVE-2024-10924)

CVE-2024-10924 is a critical authentication bypass vulnerability in the Really Simple Security WordPress plugin, affecting versions 9.0.0 through 9.1.1.1. The flaw exists in the two-factor authentication (2FA) functionality due to improper error handling in the check_login_and_get_user function. An unauthenticated attacker can exploit this by sending a crafted HTTP POST request to the /wp-json/reallysimplessl/v1/two_fa/skip_onboarding REST API endpoint. Successful exploitation allows an attacker to impersonate any user, including accounts with administrative privileges, completely bypassing 2FA requirements. Multiple public exploit scripts are available and confirmed to be circulating.

Attack Chain

1. Attacker identifies a WordPress site running the vulnerable Really Simple Security plugin.
2. Attacker sends a crafted HTTP POST request to the /wp-json/reallysimplessl/v1/two_fa/skip_onboarding REST API endpoint.
3. The vulnerable check_login_and_get_user function fails to validate the request properly due to an error handling flaw.
4. The application returns valid session cookies for the target user (e.g., admin) to the attacker.
5. Attacker retrieves the session cookies from the API response.
6. Attacker injects these cookies into their own browser session to access the WordPress dashboard as the targeted user without providing a password or 2FA credentials.

Impact

Successful exploitation results in full administrative access to the affected WordPress installation. This allows for complete site compromise, including arbitrary code execution, data exfiltration, and administrative configuration changes.

Recommendation

1. Immediately update the Really Simple Security plugin to version 9.1.2 or later on all WordPress instances.
2. Inventory all WordPress installations within the environment to identify any sites running versions 9.0.0 through 9.1.1.1.
3. Review web server access logs for anomalous POST requests to the /wp-json/reallysimplessl/v1/two_fa/skip_onboarding endpoint.