CVE-2026-89080: Unknown Really Simple Security

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

Affected products

• Unknown Really Simple Security: from 9.5.10.1, before 9.8.1 (fixed in 9.8.1)

Published 2026-09-13. Last modified 2026-09-14.