CVE-2026-8293 describes an improper authentication vulnerability in the Really Simple Security WordPress plugin prior to version 9.5.10.1. Specifically, two REST endpoints related to two-factor authentication do not enforce the second-factor email OTP challenge. As a result, an attacker with knowledge of a user's password can bypass the second factor and gain an authenticated session as that user. This flaw violates the intended two-factor authentication mechanism, undermining account security.

An attacker who knows a valid user's password can bypass the second-factor authentication step and obtain a valid WordPress authentication session. This compromises the confidentiality, integrity, and availability of the affected user's account, potentially allowing unauthorized access and actions within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider disabling the affected two-factor authentication REST endpoints or the Really Simple Security plugin if feasible to prevent exploitation.