{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/really-simple-plugins/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:*:wordpress:*:*","cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:-:wordpress:*:*","cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro:wordpress:*:*","cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro_multisite:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2024-10924"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Really Simple Security (\u003c 9.1.2)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","cve","auth-bypass","web-application"],"_cs_type":"advisory","_cs_vendors":["Really-simple-plugins"],"content_html":"\u003cp\u003eCVE-2024-10924 is a critical authentication bypass vulnerability in the Really Simple Security WordPress plugin, affecting versions 9.0.0 through 9.1.1.1. The flaw exists in the two-factor authentication (2FA) functionality due to improper error handling in the \u003ccode\u003echeck_login_and_get_user\u003c/code\u003e function. An unauthenticated attacker can exploit this by sending a crafted HTTP POST request to the \u003ccode\u003e/wp-json/reallysimplessl/v1/two_fa/skip_onboarding\u003c/code\u003e REST API endpoint. Successful exploitation allows an attacker to impersonate any user, including accounts with administrative privileges, completely bypassing 2FA requirements. Multiple public exploit scripts are available and confirmed to be circulating.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WordPress site running the vulnerable Really Simple Security plugin.\u003c/li\u003e\n\u003cli\u003eAttacker sends a crafted HTTP POST request to the \u003ccode\u003e/wp-json/reallysimplessl/v1/two_fa/skip_onboarding\u003c/code\u003e REST API endpoint.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003echeck_login_and_get_user\u003c/code\u003e function fails to validate the request properly due to an error handling flaw.\u003c/li\u003e\n\u003cli\u003eThe application returns valid session cookies for the target user (e.g., admin) to the attacker.\u003c/li\u003e\n\u003cli\u003eAttacker retrieves the session cookies from the API response.\u003c/li\u003e\n\u003cli\u003eAttacker injects these cookies into their own browser session to access the WordPress dashboard as the targeted user without providing a password or 2FA credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative access to the affected WordPress installation. This allows for complete site compromise, including arbitrary code execution, data exfiltration, and administrative configuration changes.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately update the Really Simple Security plugin to version 9.1.2 or later on all WordPress instances.\u003c/li\u003e\n\u003cli\u003eInventory all WordPress installations within the environment to identify any sites running versions 9.0.0 through 9.1.1.1.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous POST requests to the \u003ccode\u003e/wp-json/reallysimplessl/v1/two_fa/skip_onboarding\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-28T15:02:54Z","date_published":"2026-10-28T15:02:54Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-10924-auth-bypass/","summary":"An authentication bypass vulnerability in the Really Simple Security WordPress plugin (versions 9.0.0-9.1.1.1) allows unauthenticated attackers to gain administrative access via the REST API.","title":"Really Simple Security: Authentication Bypass (CVE-2024-10924)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-10924-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Really-Simple-Plugins","version":"https://jsonfeed.org/version/1.1"}