Unauthenticated 2FA Bypass in Really Simple Security Plugin

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-89080 represents a critical authentication bypass vulnerability in the Really Simple Security WordPress plugin versions before 9.8.1. The flaw allows unauthenticated attackers to reset a user's two-factor authentication enrollment status without proper authorization, effectively neutering the second authentication layer. Once an attacker has obtained a user's password through phishing, credential stuffing, or other means, they can exploit this vulnerability to disable 2FA and hijack the account—potentially escalating to administrator privileges if the compromised account holds such permissions. This vulnerability is particularly dangerous in WordPress environments where administrators often manage sensitive website configurations, user data, and plugin functionality.

Casky's 283 mapped security skills leverage Claude's extended reasoning to identify the attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0004) and Credential Access (TA0006) tactics. Practitioners using Casky would observe detection findings related to unauthenticated state-changing requests (CWE-287: Improper Authentication), suspicious attempts to modify authentication settings without valid session tokens, and behavioral patterns consistent with account takeover workflows. The platform would flag requests that reset 2FA enrollment without proper multi-factor verification, allowing security teams to correlate these signals with known password compromise indicators and detect attackers in the exploitation phase before they establish persistence or move laterally within the WordPress environment.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-89080.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-89080

Casky has 283 skills that investigate the attack patterns behind CVE-2026-89080. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn