CVE-2026-82519 Details

A missing authorization check vulnerability has been identified in the Really Simple Security plugin for WordPress, affecting versions prior to 9.8.2. This vulnerability allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely. The issue arises from an unguarded code path in the profile-page update handler, which attackers can exploit by sending a crafted POST request that omits the two-factor-authentication field. This exploitation skips nonce verification and triggers the delete_two_fa_meta() function, resetting the grace period anchor timestamp with each login. As a result, mandatory two-factor authentication enforcement is deferred indefinitely.