CVE-2026-82519 describes a missing authorization check in the Really Simple Security WordPress plugin prior to version 9.8.2. Authenticated low-privileged attackers can exploit an unguarded code path in the profile-page update handler by sending a crafted POST request without the two-factor-authentication field. This bypasses nonce verification and triggers the delete_two_fa_meta() function, which resets the grace period anchor timestamp on each login cycle. As a result, mandatory two-factor authentication enforcement is indefinitely deferred, allowing attackers to avoid 2FA requirements.

The vulnerability allows authenticated users with low privileges to bypass mandatory two-factor authentication indefinitely. This reduces the security posture of affected WordPress sites by allowing attackers to avoid 2FA protections, potentially increasing the risk of unauthorized access if credentials are compromised. However, the CVSS score of 2.3 and low severity rating indicate the impact is limited and requires authentication with low privileges.

A fix is available in Really Simple Security plugin version 9.8.2. Users should upgrade to version 9.8.2 or later to remediate this missing authorization check vulnerability and restore proper two-factor authentication enforcement.