UNKNOWN NVD

CVE-2026-89080

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enr

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

References

https://wpscan.com/vulnerability/49546064-5663-40f8-be7c-4f3faa31fa9a/

Published: 2026-09-13 · Source: NVD · Feed updated: 2026-09-13

This unknown severity vulnerability was published on 2026-09-13 via NVD.

vulnfeed aggregates 13605 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.