Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
Really Simple Security 9.8.1未満に、メールによる2要素認証を回避できる脆弱性（CVSS 7.5）が公開されています。 攻撃には対象ユーザーの正しいパスワードを知っている必要がありますが、2FAを使っているからパスワードが漏れても大丈夫とは考えないで！最新版に更新を！ https://www.cve.org/CVERecord?id=CVE-2026-89080
Post summary
The text discloses CVE-2026-89080, a CSRF-based 2FA bypass vulnerability (CVSS 7.5) in Really Simple Security versions below 9.8.1, and explicitly urges users to update to the latest version as remediation.
Si usas Really Simple Security, actualiza a 9.8.1. Sin login resetean el 2FA; con tu clave entran como admin. Si no, el segundo factor no te salva. https://www.wavys-technologies.com/es/blog/really-simple-security-cve-2026-89080
Post summary
The tweet discloses a vulnerability in Really Simple Security (CVE‑2026‑89080) that allows attackers to bypass two‑factor authentication, reset 2FA, and gain admin access, and it advises users to update to version 9.8.1.