What is GHSA-36qh-hpmx-m9cv?

GHSA-36qh-hpmx-m9cv is a security advisory published by GitHub Security Advisories with High severity. The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated...

Which CVE IDs does GHSA-36qh-hpmx-m9cv cover?

GHSA-36qh-hpmx-m9cv covers the following CVE IDs: CVE-2026-89080. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-36qh-hpmx-m9cv?

GHSA-36qh-hpmx-m9cv has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-36qh-hpmx-m9cvHighCVSS 7.5

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated...

Vendor

GitHub Security Advisories

Published

September 13, 2026

Last Modified

September 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-89080 →

📋 Description

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-89080
https://wpscan.com/vulnerability/49546064-5663-40f8-be7c-4f3faa31fa9a
https://github.com/advisories/GHSA-36qh-hpmx-m9cv