MalCare Protects Against Critical Vulnerability In Really Simple Security Plugin

On November 6th, 2024, a critical vulnerability was discovered in the Really Simple Security plugin. This vulnerability affects versions 9.0.0 to 9.1.1.1, including the free, pro, and pro multisite versions. This vulnerability could allow unauthorized users to bypass your site’s security, posing serious risks to your WordPress site.

If you are using this plugin, we recommend scanning your site immediately to identify any potential issues and address them promptly.

What is the vulnerability?

If your site is one among the 4 million sites using the Really Simple Security plugin with two-factor authentication enabled, it’s important to note a critical issue. Versions 9.0.0 to 9.1.1.1 have a severe authentication bypass vulnerability.

This issue is particularly dangerous because it is scriptable, making it easy for attackers to automate large-scale exploitation. This means they could break into your site and access accounts, even those with admin rights. 

Once in, they could take control of your site, alter or delete content, steal sensitive data, or introduce malicious software.

Should you be worried?

Yes, this is a serious concern. The vulnerability in the Really Simple Security plugin is quite severe, with a CVSS score of 9.8, indicating a critical threat. 

To protect your site from potential exploitation, it is essential to update the plugin to version 9.1.2 or newer without delay.

What should you do next?

To keep your site secure, it’s important to act immediately. Here’s what you should do:

What if your site is already compromised?

If you suspect that your site has fallen prey to this vulnerability, it’s vital to take immediate action. Here’s what you should do:

Technical details of the vulnerabilities

Issue

The Really Simple Security plugin has a critical issue known as an authentication bypass vulnerability. This problem occurs when the two-factor authentication feature is enabled, giving attackers the opportunity to bypass normal security measures and access accounts without authorization. 

Root cause

The vulnerability in the Really Simple Security plugin stems from improperly handling errors during authentication. When two-factor authentication is enabled, the plugin might fail and return a WP_REST_Response error. 

Because this error isn’t managed correctly in the code, the authentication process can continue even when it’s not supposed to.

This oversight allows the authenticate_and_redirect() function to be triggered. This function authenticates users based on the user ID included in the request, without verifying the user’s identity. 

Consequently, unauthenticated attackers could exploit this weakness to gain unauthorized access to user accounts, including those with administrative privileges, without needing valid credentials. This vulnerability opens the door for significant security breaches, especially when two-factor authentication settings are in play.

Timeline

How MalCare protects your site

If you are a MalCare user, your site is protected against the critical authentication bypass vulnerability in the Really Simple Security plugin. MalCare’s advanced Atomic Security firewall proactively safeguards your site without any manual intervention. Here’s how:

How to keep your site secure

Keeping your WordPress site secure is crucial to protect it from potential threats and vulnerabilities. Here are some straightforward steps to enhance your site’s security:

1. Security plugins: Use a reliable security plugin, like MalCare, to provide extra protection. These plugins offer features like malware scanning, firewall protection, and activity monitoring to safeguard your site.
2. Regular backups: Schedule regular backups of your site’s data and files. This ensures you can quickly restore your site to its previous state if an issue arises.
3. Regular updates: Always keep your WordPress core, themes, and plugins up to date. Developers frequently release updates to patch security vulnerabilities, so it’s important to install them promptly.
4. Strong passwords: Use complex, unique passwords for all accounts associated with your site, including database, FTP, and admin accounts. Consider using a password manager to safely generate and store passwords.
5. Two-factor authentication: Enable two-factor authentication to add an extra layer of security. This requires a second form of verification, usually a code sent to your phone, making it harder for unauthorized users to access your site.
6. Monitor activity: Regularly monitor site activity and logs for any suspicious actions. This can help you detect and respond to potential threats before they cause significant harm.