CVE-2026-27397

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27397", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-19T09:52:08.214Z", "datePublished": "2026-03-19T05:30:18.525Z", "dateUpdated": "2026-04-28T16:15:02.887Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Really Simple Security Pro", "vendor": "Really Simple Plugins B.V.", "versions": [{"changes": [{"at": "9.5.4.1", "status": "unaffected"}], "lessThanOrEqual": "9.5.4.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "dcodx | Patchstack Bug Bounty Program"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Really Simple Security Pro: from n/a through 9.5.4.0.</p>"}], "value": "Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple Security Pro: from n/a through 9.5.4.0."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:02.887Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/really-simple-ssl-pro/vulnerability/wordpress-really-simple-security-pro-plugin-9-5-3-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the WordPress Really Simple Security Pro plugin to the latest available version (at least 9.5.4.1)."}], "value": "Update the WordPress Really Simple Security Pro plugin to the latest available version (at least 9.5.4.1)."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T13:45:41.733251Z", "id": "CVE-2026-27397", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T13:45:55.021Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-19T13:45:41.733251Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T13:45:51.559Z"}}], "cna": {"title": "WordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "dcodx | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Really Simple Plugins B.V.", "product": "Really Simple Security Pro", "versions": [{"status": "affected", "changes": [{"at": "9.5.4.1", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "9.5.4.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress Really Simple Security Pro plugin to the latest available version (at least 9.5.4.1).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress Really Simple Security Pro plugin to the latest available version (at least 9.5.4.1).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/really-simple-ssl-pro/vulnerability/wordpress-really-simple-security-pro-plugin-9-5-3-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple Security Pro: from n/a through 9.5.4.0.", "supportingMedia": [{"type": "text/html", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Really Simple Security Pro: from n/a through 9.5.4.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-19T05:30:18.525Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27397", "state": "PUBLISHED", "dateUpdated": "2026-03-19T13:45:55.021Z", "dateReserved": "2026-02-19T09:52:08.214Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-19T05:30:18.525Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Really Simple Security Pro", "vendor": "Really Simple Plugins B.V.", "versions": [{"changes": [{"at": "9.5.4.1", "status": "unaffected"}], "lessThanOrEqual": "9.5.4.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple Security Pro: from n/a through 9.5.4.0."}, {"lang": "es", "value": "Vulnerabilidad de elusi\u00f3n de autorizaci\u00f3n a trav\u00e9s de clave controlada por el usuario en Really Simple Plugins B.V. Really Simple Security Pro permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Really Simple Security Pro: desde n/a hasta 9.5.4.0."}], "id": "CVE-2026-27397", "lastModified": "2026-06-17T10:27:07.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27397", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-19T13:45:41.733251Z", "version": "2.0.3"}}]}, "published": "2026-03-19T06:16:25.410", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/really-simple-ssl-pro/vulnerability/wordpress-really-simple-security-pro-plugin-9-5-3-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.5.4.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[9.5.4.1,*]"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "Really Simple Security Pro", "source": "cna", "vendor": "Really Simple Plugins B.V."}, "product": "really_simple_security", "vendor": "really-simple-plugins"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-29T00:49:39.759811+00:00", "value": {"mitigation_remediation": ["Update the WordPress Really Simple Security Pro plugin to version 9.5.4.1 or later.", "Verify that the plugin\u2019s access control settings are correctly configured to prevent unintended exposure of protected resources.", "Monitor site logs for anomalous IDOR attempts or unauthorized access to sensitive data."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized Data Access"}, "threat_synthesis": {"affected_systems": "Really Simple Plugins B.V. \u2013 Really Simple Security Pro plugin is affected from its earliest release through version 9.5.4.0. Any site using these versions is susceptible; an upgrade beyond 9.5.4.0 removes the flaw.", "description_and_impact": "The vulnerability is an Insecure Direct Object Reference (IDOR) flaw that allows an attacker to bypass normal access controls by manipulating user-controlled keys. Because the plugin does not enforce proper authorization checks, a malicious user can request resources or configuration data that they should not normally be able to access. This leads to unauthorized disclosure of sensitive information, potentially compromising the integrity of site configuration and user data. The weakness is classified as CWE\u2011639 based on the description of the authorization bypass.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a moderate severity. The EPSS score is less than 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote web-based exploitation through the plugin\u2019s administrative interface, where an attacker can supply altered key parameters. The available information does not specify whether the attacker must be authenticated; the flaw exploits incorrect access control and allows unauthorized access to protected resources."}}}}, "created": "2026-03-19T08:54:35.180152+00:00", "updated": "2026-04-29T01:00:11.350492+00:00", "vendors": ["really-simple-plugins", "really-simple-plugins$PRODUCT$really_simple_security", "wordpress", "wordpress$PRODUCT$wordpress"]}