The Really Simple Security plugin fails to enforce the second‑factor email OTP on two of its two‑factor authentication REST endpoints. When an attacker knows the target user’s password, they can bypass the one‑time password challenge and obtain a valid WordPress authentication session. This flaw effectively removes the second factor of authentication, allowing full access to the user account and, depending on the account’s privileges, potentially administration of the entire WordPress site. The weakness is an improper enforcement of authentication controls, exposing the site to credential‑reuse attacks and granting attackers the same capabilities as the target user.

Anyone using the Really Simple Security WordPress plugin with a version lower than 9.5.10.1 is impacted. The vulnerability is specific to that plugin, and no other vendors or products are listed as affected.

CVSS score of 7.5, EPSS score of 0.00067, and no KEV listing are the current metrics for the vulnerability. The nature of the flaw—overt authentication bypass—suggests a high risk to confidentiality and integrity. An attacker can easily exploit the exposed REST endpoints from off‑site with only the user’s password, making remote exploitation straightforward with no specialized environment required. The lack of an official KEV flag does not reduce the urgency; any site that relies on the plugin for two‑factor protection remains vulnerable until addressed.