WordPress plugin
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 13 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High2
- Medium10
- Low0
All Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Unauthenticated Unbounded Option Growth ≤9.8.2Update to 9.8.3 | CVE-2026-88798 | |
| Medium4.3 | Missing Authorization to 2FA Bypass ≤9.8.1Update to 9.8.2 | CVE-2026-82519 | |
| Medium5.3 | Unauthenticated Two-Factor Authentication Bypass ≤9.8.0Update to 9.8.1 | CVE-2026-89080 | |
| Medium5.3 | Unauthenticated Two-Factor Authentication Bypass ≤9.8.0Update to 9.8.1 | CVE-2026-84777 | |
| High7.5 | Unauthenticated Denial of Service ≤9.8.0Update to 9.8.1 | CVE-2026-84775 | |
| High8.8 | Authenticated (Custom Role+) Remote Code Execution <9.8.0Update to 9.8.0 | CVE-2026-81766 | |
| Medium5.3 | Two Factor Authentication Bypass ≤9.5.10.0Update to 9.5.10.1 | CVE-2026-8293 | |
| Medium5.3 | Missing Authorization ≤9.5.10Update to 9.5.10.1 | CVE-2026-48970 | |
| Medium4.3 | Missing Authorization ≤9.5.9Update to 9.5.10 | CVE-2026-48969 | |
| Medium4.3 | Missing Authorization ≤9.5.7Update to 9.5.8 | CVE-2026-32461 | |
| Medium4.3 | Cross-Site Request Forgery ≤9.1.4Update to 9.2.0 | CVE-2025-24623 | |
| Critical9.8 | 9.1.1.1 - Authentication Bypass 9.0.0 – 9.1.1.1Update to 9.1.2 | CVE-2024-10924 | |
| Medium5.5 | Authenticated (Admin+) Server-Side Request Forgery ≤7.2.3Update to 8.0.0 | CVE-2024-31229 |
- Medium5.3Unauthenticated Unbounded Option Growth
≤9.8.2Update to 9.8.3
- Medium4.3Missing Authorization to 2FA Bypass
≤9.8.1Update to 9.8.2
- Medium5.3Unauthenticated Two-Factor Authentication Bypass
≤9.8.0Update to 9.8.1
- Medium5.3Unauthenticated Two-Factor Authentication Bypass
≤9.8.0Update to 9.8.1
- High7.5Unauthenticated Denial of Service
≤9.8.0Update to 9.8.1
- High8.8Authenticated (Custom Role+) Remote Code Execution
<9.8.0Update to 9.8.0
- Medium5.3Two Factor Authentication Bypass
≤9.5.10.0Update to 9.5.10.1
- Medium5.3Missing Authorization
≤9.5.10Update to 9.5.10.1
- Medium4.3Missing Authorization
≤9.5.9Update to 9.5.10
- Medium4.3Missing Authorization
≤9.5.7Update to 9.5.8
- Medium4.3Cross-Site Request Forgery
≤9.1.4Update to 9.2.0
- Critical9.89.1.1.1 - Authentication Bypass
9.0.0 – 9.1.1.1Update to 9.1.2
- Medium5.5Authenticated (Admin+) Server-Side Request Forgery
≤7.2.3Update to 8.0.0
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL): common questions
Does Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) have known vulnerabilities?
Yes. VulnCrest Radar lists 13 known vulnerabilities in Really Simple Security – Simple and Performant Security (formerly Really Simple SSL): 1 critical, 2 high, 10 medium. None are known to affect version null.
How do I check which version of Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) vulnerability?
CVE-2026-88798, published Sep 16, 2026: Really Simple Security (Free) <= 9.8.2 - Unauthenticated Unbounded Option Growth. Severity: Medium (CVSS 5.3).
Is any Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) vulnerability listed in CISA KEV?
No. None of the known Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) vulnerabilities is currently listed in the CISA KEV catalog.