← back to popular plugins
wordfence / plugin · really-simple-ssl
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
really-simple-ssl
total installs
3,000,000
total vulns
11
critical
0
high
2
medium
9
low
0
latest vuln
—
patched
11
unpatched
0
avg time to patch
—
vulnerabilities
(11)
Really Simple Security (Free) <= 9.8.2 - Unauthenticated Unbounded Option Growth
medium
✓ patched
cve id
CVE-2026-88798 ↗
cvss score
5.3
cwe
CWE-400: Uncontrolled Resource Consumption
published
Sep 16, 2026
The Really Simple Security (Free) plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 9.8.2. This is due to missing validation on client-supplied IP headers used as storage keys in the rsssl_404_cache option, allowing arbitrary values from HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR to be written as array keys without bound. This makes it possible for unauthenticated attackers to grow the rsssl_404_cache option without bound by supplying arbitrary values in spoofed client IP headers, degrading site performance when handling 404 responses.
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.1 - Missing Authorization to 2FA Bypass
medium
✓ patched
The Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 9.8.1. This is due to a missing capability check on a function. This makes it possible for authenticated attackers to disable a 2FA grace period and bypass 2FA.
Really Simple Security <= 9.8.0 - Unauthenticated Two-Factor Authentication Bypass
medium
✓ patched
cve id
CVE-2026-89080 ↗
cvss score
5.3
cwe
CWE-693: Protection Mechanism Failure
published
Sep 11, 2026
The Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 9.8.0. This makes it possible for unauthenticated attackers to bypass two-factor authentication.
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.0 - Unauthenticated Two-Factor Authentication Bypass
medium
✓ patched
The Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin for WordPress is vulnerable to 2FA Bypass in all versions up to, and including, 9.8.0. This makes it possible for unauthenticated attackers to bypass 2FA.
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.0 - Unauthenticated Denial of Service
high
✓ patched
cve id
CVE-2026-84775 ↗
cvss score
7.5
cwe
CWE-400: Uncontrolled Resource Consumption
published
Sep 2, 2026
The Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 9.8.0. This is due to insufficient validation of user supplied input. This makes it possible for unauthenticated attackers to make the affected site unavailable.
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) < 9.8.0 - Authenticated (Custom Role+) Remote Code Execution
high
✓ patched
cve id
CVE-2026-81766 ↗
cvss score
8.8
cwe
CWE-94: Improper Control of Generation of Code ('Code Injection')
published
Aug 31, 2026
The Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to 9.8.0. This is due to insufficient validation of user supplied input before it is executed. This makes it possible for authenticated attackers, with custom role-level access and above, to execute arbitrary code on the server.
Really Simple Security <= 9.5.10.0 - Two Factor Authentication Bypass
medium
✓ patched
The Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin for WordPress is vulnerable to Two Factor Authentication Bypass in all versions up to, and including, 9.5.10.0. This makes it possible for unauthenticated attackers to bypass the second factor of authentication when the first is known.
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.10 - Missing Authorization
medium
✓ patched
The Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 9.5.10. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.9 - Missing Authorization
medium
✓ patched
The Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 9.5.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.7 - Missing Authorization
medium
✓ patched
The Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 9.5.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
Really Simple SSL <= 9.1.4 - Cross-Site Request Forgery
medium
✓ patched
cve id
CVE-2025-24623 ↗
cvss score
4.3
cwe
CWE-352: Cross-Site Request Forgery (CSRF)
published
Jan 24, 2025
The Really Simple SSL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 9.1.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.