Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Unknown/Really Simple Security (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Unknown/Really Simple Security.
2. 2Review the reported fix. Update Unknown/Really Simple Security to 9.8.1 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 13, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 13, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 13, 2026

Sources and claim methodology

• Source referencewpscan.com

Related CVEs

• Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' ParameterSame generic ecosystem
• MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account CreationSame generic ecosystem
• Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entrySame generic ecosystem
• User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to AdministratorSame generic ecosystem
• User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect ParametersSame generic ecosystem
• User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership PurchaseSame generic ecosystem