A critical security vulnerability has been discovered in the popular WordPress plugin Really Simple Security, exposing over 4 million websites to potential complete takeover by attackers. This severe flaw, tracked as CVE-2024-10924, impacts versions 9.0.0 to 9.1.1.1 and allows unauthorized access to administrator accounts, even if two-factor authentication (2FA) is enabled.
The issue was identified by the security team at Wordfence, who determined that poor error handling in the plugin’s two-factor REST API was the root cause. The vulnerability carries a critical CVSS score of 9.8, underscoring the significant risk it poses to affected sites.
In response to the discovery, the developers of Really Simple Security have released a patched version, 9.1.2, which addresses the vulnerability. WordPress administrators are strongly encouraged to update their plugins immediately to ensure their sites are protected against potential exploits.
Additionally, Wordfence has reported another critical vulnerability in a different WordPress plugin, the WPLMS Learning Management System. This flaw, identified as CVE-2024-10470, affects versions prior to 4.963 and may lead to arbitrary code execution due to inadequate file path validation and permissions checks. Users of WPLMS are advised to update to the latest version to mitigate this risk.
Ensuring that all plugins and themes are up to date is a crucial step in maintaining the security of WordPress sites. Regular updates and security patches help protect against known vulnerabilities and emerging threats.

Collections

A critical security vulnerability in the WordPress plugin Really Simple Security endangers over 4 million websites by allowing unauthorized access to administrator accounts. The flaw, tracked as CVE-2024-10924, affects versions 9.0.0 to 9.1.1.1 and has a CVSS score of 9.8. A patched version 9.1.2 has been released, and users are urged to update immediately. Another critical vulnerability, CVE-2024-10470, was found in the WPLMS Learning Management System plugin. Users should ensure all plugins and themes are regularly updated to maintain site security.

Critical Vulnerabilities in WordPress Plugins Expose Over 4 Million Sites