CVE-2024-10924

CVE-2024-10924 is a critical (CVSS 9.8) unauthenticated authentication bypass in the Really Simple Security plugin for WordPress (Free, Pro, and Pro Multisite editions), affecting versions 9.0.0 through 9.1.1.1. It stems from improper user check error handling in the 'check_login_and_get_user' function used by the two-factor REST API actions, and can be triggered when the plugin's 'Two-Factor Authentication' setting is enabled (it is disabled by default). An unauthenticated attacker can exploit it to log in as any existing user on the site, including an administrator, gaining full control of the affected WordPress site. Any WordPress site running one of the affected plugin versions with two-factor authentication turned on is exposed, and public reporting indicates the plugin is installed on more than 4 million sites. As of the latest data there is no confirmed in-the-wild exploitation, no public proof-of-concept, and it is not in CISA's KEV catalog, but EPSS assigns an 82% probability of exploitation within the next 30 days (99th+ percentile), so rapid patching is warranted.

What to do: Update the Really Simple Security plugin to a fixed release (any version after 9.1.1.1) on all Free, Pro, and Pro Multisite installations. As an interim mitigation, disable the 'Two-Factor Authentication' setting or restrict access to the WordPress REST API until patched. After updating, review recent authentication logs and administrator accounts for signs of unauthorized logins.