CVE-2026-82519: Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler
reallysimpleplugins · Really Simple Security
Fixed in 9.8.2 · Affected: reallysimpleplugins Really Simple Security before 9.8.2 · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 30% of scored CVEs
DescriptionCVE.org
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- reallysimpleplugins · Really Simple Securitybefore 9.8.2
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- reallysimpleplugins
- Published
- September 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-82519 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.