Really Simple Security - Authentication Bypass (CVE-2024-10924)
Description
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
psychologyCrowdSec Analysis
CVE-2024-10924 is a critical vulnerability impacting the Really Simple Security plugins for WordPress, allowing authentication bypass through improper user check error handling in the two-factor REST API.
CrowdSec has been tracking this vulnerability and its exploits since 18th of November 2024.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-10924 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Exploitation attempts are typically associated with requests to URLs containing /wp-json/reallysimplessl/v1/two_fa/skip_onboarding.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-11-15 |
| Rule Released | 2024-11-18 |
| CrowdSec First Seen | 2024-11-25 |