# CVE-2024-10924: Really Simple Security - Authentication Bypass

> Live exploitation tracking for CVE-2024-10924 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-10924

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Really Simple Plugins Really Simple Security Pro
- **Weaknesses:** CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
- **Tags:** cms, wordpress

## Description

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

## CrowdSec analysis

[CVE-2024-10924](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-10924) is a critical vulnerability impacting the Really Simple Security plugins for WordPress, allowing authentication bypass through improper user check error handling in the two-factor REST API.

CrowdSec has been tracking this vulnerability and its exploits since 18th of November 2024.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-10924 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Exploitation attempts are typically associated with requests to URLs containing `/wp-json/reallysimplessl/v1/two_fa/skip_onboarding`.

## Timeline

- 2024-11-15: CVE Published. CVE-2024-10924 is published to NVD.
- 2024-11-18: Rule Released. CrowdSec releases a rule to detect CVE-2024-10924 exploitation attempts against the CrowdSec Network.
- 2024-11-25: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-10924 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10924.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-10924) follows observed exploitation activity for CVE-2024-10924. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.