When a "security" plugin lets the burglar in itself
You install a "security" plugin to sleep soundly. And then it turns out it was the one that left the door open. That is what happened with Really Simple Security (formerly Really Simple SSL) in late 2024.
What happened
The plugin, installed on about 4 million sites, had a flaw in its handling of two-factor login (CVE-2024-10924). With a suitably crafted request an attacker could log in as any user, all they needed was to know or guess the login. And an administrator's login is often not hard to work out.
It is one of those flaws that specialists call "the worst possible scenario": an authentication bypass, remote, without a password, on a mass scale. WordPress.org forced an automatic update to limit the fallout.
The lesson that stings
Security plugins are software too, and every piece of software has bugs. Simply installing a "protection plugin" is not a shield. What counts is whether everything is up to date and whether someone is keeping an eye on it.
What to do
- Update security plugins as scrupulously as the rest, perhaps even more so.
- Do not pile up plugins "just in case". Three overlapping protection plugins mean three times as much code that can have a flaw.
- Enable automatic updates at least for the critical add-ons.
Security is not "install and forget", it is a process. As part of ongoing care we keep a finger on the pulse: we track which plugins have freshly discovered flaws and react at once, see how.
Source: NVD, CVE-2024-10924.