CVE-2024-10924 in WordPress: when a security plugin allows entry as administrator

Published on 2026-10-27 by frfrand

The real case of Really Simple Security: how it was discovered, who was exposed, how to fix it and review access.

The problem: installing a security plugin does not guarantee protection

In November 2024, a critical flaw in Really Simple Security, formerly called Really Simple SSL, became known. It is a useful lesson: even a plugin designed to protect a site can introduce an authentication error. The vulnerability CVE-2024-10924 could allow someone without logging in to access as an existing user, including an administrator, when the affected two-factor authentication feature was enabled.

Who discovered it and how was it communicated?

István Márton, a Wordfence researcher, identified the issue on November 6, 2024. Wordfence initiated coordinated disclosure with the developer. The vendor released patches for paid versions on November 12 and for the free version on November 14; it collaborated with WordPress.org to push security updates. The original announcement mentioned more than four million sites with the plugin installed at that time: not all necessarily vulnerable, because version and configuration matter.

How could it be exploited?

The flaw was in the error handling of a REST API function related to the second factor. In certain cases, a failed verification returned an error object, but the calling flow continued without properly blocking authentication. The risk was impersonating a user and obtaining a session with their privileges. The failure does not require breaking the second factor encryption: it bypasses part of the logic that should have made it mandatory.

Why was it so serious?

With administrator access, an attacker can change users, plugins, content, and settings. From there they can attempt to extract information or maintain persistent access. Wordfence rated the case as critical, 9.8 on CVSS 3.1. This does not mean that all WordPress installations were compromised; it means that those that met the conditions had to prioritize the patch.

Which installations were affected?

Versions 9.0.0 to 9.1.1.1 of Really Simple Security, including Free, Pro, and Pro Multisite variants, with the affected two-factor authentication enabled. Version 9.1.2 introduced the historical fix. Today it corresponds to install the latest and maintained version of the plugin, not stopping at an old revision.

How do I review my WordPress?

From the panel, identify the plugin version and the status of its authentication functions. Check that WordPress, plugins, and themes have updates applied. Review unknown administrator users, recent configuration changes, sessions, and access logs, especially if the site was vulnerable. Before modifying the site, generate a backup and keep evidence if you suspect an intrusion.

How is it fixed?

Update Really Simple Security to a patched and maintained version, verify that login works, review active sessions, and rotate credentials if there are signs of compromise. Temporarily disabling a WAF or changing the access path name is not enough. If the site has orders or personal data, treat recovery as a priority.

Frequently asked questions

Does deactivating the plugin fix everything? It may remove an exposure vector, but it does not fix the code or undo previous unauthorized access.

Are all security plugins insecure? No: this case shows why they also need maintenance and audits.

How is something similar avoided? Plugin inventory, least privilege, backups, tested updates, and monitoring.

Sources: Wordfence Research · CVE Record and Scope.

Where to follow alerts and request support?

At ArduMaker we explain new vulnerabilities and share guidance on version review, updates, and containment measures. You can check the ArduMaker CVE and support page. If your system does not use WordPress, still indicate the technology, version, and configuration when describing the case to evaluate what needs to be reviewed. A published alert does not mean that all servers of that technology are affected, nor that a pending update implies a confirmed intrusion.

Editorial update: October 2026. Always check the official notice for possible version changes and mitigations.

Practical example: reviewing a WordPress site with Really Simple Security

Situation: you manage an academy with registered students and the Really Simple Security plugin active. You discover that there was an authentication bypass related to the two-factor option. The question is not "do I have WordPress?", but did I use the affected version and feature?

From the VPS, if you have WP-CLI available and are in the correct site folder:

wp plugin list --fields=name,version,status --format=table
wp user list --role=administrator --fields=ID,user_login,user_email

Before: outdated plugin, vulnerable 2FA, and unsupervised administrator accounts. After: update to the maintained version, validation of two-factor access, review of unexpected administrators and active sessions, and rotation of secrets if there are signs of intrusion.

Example of realistic impact: someone who managed to log in as administrator could install a plugin or change the notification recipient. This does not mean it happened: check it with logs and concrete changes. If the site handles personal data, evaluate incident response obligations.