Critical Really Simple Security plugin flaw impacts 4M+ WordPress sites

A Really Simple Security plugin flaw affects 4M+ sites, allowing attackers full admin access. It’s one of the most critical WordPress vulnerabilities ever.

Wordfence researchers warn of a vulnerability, tracked as CVE-2024-10924 (CVSS Score of 9.8), in the Really Simple Security plugin that affects 4M+ sites. The Really Simple Security plugin, formerly Really Simple SSL, is a popular WordPress tool that enhances website security with features like login protection, vulnerability detection, and two-factor authentication. Wordfence’s researcher István Márton discovered the vulnerability on November 6, 2024.

According to the researchers, this is one of the most serious vulnerabilities they have discovered in their 12-year activity. This vulnerability affects Really Simple Security, formerly known as Really Simple SSL, installed on over 4 million websites, and allows an attacker to remotely gain full administrative access to a site running the plugin.

The vulnerability is an authentication bypass vulnerability in the Really Simple Security plugin, and in the Really Simple Security Pro and Pro Multisite plugins. An attacker could exploit the vulnerability to remotely gain access to any account on the site, including the administrator account, when the two-factor authentication feature is enabled.

The Really Simple Security plugin, formerly Really Simple SSL, introduced two-factor authentication in its latest update, but its implementation is not secure.

The flaw is due to improper user check error handling in the two-factor REST API actions with the ‘check_login_and_get_user’ function. 

The researchers warned that the vulnerability is scriptable allowing attackers to automate its exploitation in a large-scale automated attack.

“The check_login_and_get_user() function verifies the user using the user_id and login_nonce parameters.

The most significant problem and vulnerability is caused by the fact that the function returns a WP_REST_Response error in case of a failure, but this is not handled within the function. This means that even in the case of an invalid nonce, the function processing continues and invokes authenticate_and_redirect(), which authenticates the user based on the user id passed in the request, even when that user’s identity hasn’t been verified.” reads the advisory.

“Ultimately, this makes it possible for threat actors to bypass authentication and gain access to arbitrary accounts on sites running a vulnerable version of the plugin. As always, authentication bypass vulnerabilities and resulting access to high privileged user accounts, make it easy for threat actors to completely compromise a vulnerable WordPress site and further infect it.”

This vulnerability only impacts WordPress sites who have enabled “Two-Factor Authentication” in the plugin settings.

CVE-2024-10924 impacts plugin versions from 9.0.0 and up to 9.1.1.1 of the “free,” “Pro,” and “Pro Multisite” releases. The flaw has been fixed in version 9.1.2. Security updates were released on November 12 (Pro version) and November 14 (free users). WordPress.org coordinated force updates for most users, but admins should verify they are on the latest version.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Really Simple Security plugin)