SECURITY PLUGIN FLAW IN MILLIONS OF WORDPRESS SITES GIVES ADMIN ACCESS

Summary from the TLDR InfoSec newsletter

Researchers from WordFence have discovered a new vulnerability in the Really Simple Security WordPress plugin. The vulnerability involves an error in handling an invalid login nonce in the 2FA procedure that can allow an unauthenticated user to login as an administrator. Users should ensure that they're on the latest version of the plugin. WordFence is working with the plugin developers and WordPress.org to force users to update to the latest version. The WordPress.org stats site reported 3.5M sites that were potentially vulnerable at the time of publication.