Really Simple SSL

The two-factor profile settings handler in Really Simple SSL applies 2FA profile changes to the WP_User passed via the request without verifying that it matches the currently authenticated user. An authenticated user could therefore modify another user’s two-factor authentication settings (disable 2FA, reset backup codes, change the configured method), which can be used as a stepping stone for account takeover.

This vulnerability affects the following application versions:

• Really Simple SSL 9.0.0
• Really Simple SSL 9.0.2
• Really Simple SSL 9.1.0
• Really Simple SSL 9.1.1
• Really Simple SSL 9.1.1.1
• Really Simple SSL 9.1.2

Missing or incorrect nonce validation on a function makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link

This vulnerability affects the following application versions:

• Really Simple SSL 7.2.2
• Really Simple SSL 7.2.3
• Really Simple SSL 8.0.0
• Really Simple SSL 8.1.0
• Really Simple SSL 8.1.1
• Really Simple SSL 8.1.2
• Really Simple SSL 8.1.3
• Really Simple SSL 8.1.4
• Really Simple SSL 8.1.5
• Really Simple SSL 8.1.6
• Really Simple SSL 8.3.0.1
• Really Simple SSL 9.0.0
• Really Simple SSL 9.0.2
• Really Simple SSL 9.1.0
• Really Simple SSL 9.1.1
• Really Simple SSL 9.1.1.1
• Really Simple SSL 9.1.2
• Really Simple SSL 9.1.3
• Really Simple SSL 9.1.4

This is due to improper user check error handling in the two-factor REST API actions with the ‘check_login_and_get_user’ function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the “Two-Factor Authentication” setting is enabled (disabled by default).

CVE ID: CVE-2024-10924

This vulnerability affects the following application versions:

• Really Simple SSL 9.0.0
• Really Simple SSL 9.0.2
• Really Simple SSL 9.1.0
• Really Simple SSL 9.1.1
• Really Simple SSL 9.1.1.1