Massive authentication bypass and privilege escalation vulnerabilities have hit two of the most popular WordPress plugins: Really Simple Security (CVE-2024-10924, CVSS 9.8) and LiteSpeed Cache. Site owners must take immediate steps to safeguard their administrative dashboards.

The Really Simple Security Auth Bypass Mechanism

The vulnerability lies within the plugin’s REST API implementation for two-factor authentication (2FA). Attackers need only forge an unauthenticated POST request containing an administrative user ID to receive valid session authentication cookies without ever supplying a password. Version 9.1.2 patches this critical flaw.

Protecting WordPress via Automatic Updates and WAF Rules

Beyond immediate plugin upgrades, administrators should establish web application firewall (WAF) rate limits across WordPress REST API endpoints (/wp-json/) to prevent automated credential-less account takeovers.