{"id":11412,"date":"2024-11-19T15:50:25","date_gmt":"2024-11-19T14:50:25","guid":{"rendered":"https:\/\/www.infordisa.com\/soc\/?p=11412"},"modified":"2026-09-08T12:53:55","modified_gmt":"2026-09-08T10:53:55","slug":"vulnerabilitat-critica-plugin-really-simple-security-wordpress","status":"publish","type":"post","link":"https:\/\/www.infordisa.com\/soc\/ca\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\/","title":{"rendered":"Vulnerabilitat cr\u00edtica al plugin Really Simple Security de WordPress"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
Crítica <\/span>\"Alerta<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
CVE-2024-10924<\/a><\/strong><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Descripción<\/h2>

Una vulnerabilidad<\/a> en el sistema de autentificación del ‘plugin’ de WordPress «Really Simple Security» (SSL<\/a>) ha puesto en riesgo a las más de 4 millones de páginas web<\/strong> que lo utilizan, tanto en su versión gratuita como en la de pago.<\/p>

Curiosamente este plugin de seguridad permite reforzar la navegación con herramientas de protección de inicio de sesión, sistema de autentificación multifactor (MFA<\/a>) y detección de vulnerabilidades en tiempo real. La vulnerabilidad (CVE-2024-10924<\/strong><\/a>; puntuación CCSV 9.8) permite a los atacantes obtener acceso administrativo completo de forma remota a cualquier web que lo ejecute.<\/p>

Este error permite que los atacantes no autentificados inicien sesión como cualquier otro usuario existente de WordPress como administradores cuando se habilita la configuración de la autentificación de dos factores (2FA<\/a>), que viene desactivada de forma predeterminada, según los investigadores.<\/p>

EL problema radica en la función ‘check_login_and_get_user()<\/em>‘, que verifica la identidad de los usuarios comprobando dos parámetros, ‘ser_id<\/em>‘ y ‘login_nonce<\/em>‘. Cuando se añade información errónea en este último, la solicitud de acceso no se rechaza, sino que invoca a otra función, ‘authenticate_and_redirect()<\/em>‘. Esto significa que autentifica al usuario basándose únicamente en el campo ‘user_id<\/em>‘, de forma que permite omitir la autentificación.<\/p>

Recursos afectados<\/h2>

Plugin Really Simple Security (Free, Pro y Pro Multisite) para WordPress versiones 9.0.0 a 9.1.1.1<\/p>

Solución<\/h2>

Actualizar inmediatamente el plugin Really Simple Security.<\/p>

Fuente: Wordfence<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Esta vulnerabilidad<\/a> permite a los atacantes no autentificados que inicien sesión como cualquier otro usuario existente de WordPress.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[4],"tags":[147,173],"class_list":["post-11412","post","type-post","status-publish","format-standard","hentry","category-alertas-de-seguridad","tag-vulnerabilidad","tag-wordpress","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-25"],"acf":[],"yoast_head":"Vulnerabilidad cr\u00edtica en el plugin Really Simple Security de Wordpress - INFORDISA \/ Security Operations Center<\/title>\n<meta name=\"description\" content=\"Esta vulnerabilidad permite a los atacantes no autentificados que inicien sesi\u00f3n como cualquier otro usuario existente de WordPress.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.infordisa.com\/soc\/ca\/vulnerabilitat-critica-plugin-really-simple-security-wordpress\/\" \/>\n<meta property=\"og:locale\" content=\"ca_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Vulnerabilidad cr\u00edtica en el plugin Really Simple Security de Wordpress - INFORDISA \/ Security Operations Center\" \/>\n<meta property=\"og:description\" content=\"Esta vulnerabilidad permite a los atacantes no autentificados que inicien sesi\u00f3n como cualquier otro usuario existente de WordPress.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.infordisa.com\/soc\/ca\/vulnerabilitat-critica-plugin-really-simple-security-wordpress\/\" \/>\n<meta property=\"og:site_name\" content=\"INFORDISA \/ Security Operations Center\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/infordisa\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-19T14:50:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-08T10:53:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.infordisa.com\/soc\/wp-content\/uploads\/2023\/07\/alerta-wordpress.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Jordi Sala\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.infordisa.com\/soc\/wp-content\/uploads\/2023\/07\/alerta-wordpress.jpg\" \/>\n<meta name=\"twitter:creator\" content=\"@infordisa\" \/>\n<meta name=\"twitter:site\" content=\"@infordisa\" \/>\n<meta name=\"twitter:label1\" content=\"Escrit per\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jordi Sala\" \/>\n\t<meta name=\"twitter:label2\" content=\"Temps estimat de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minuts\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\\\/\"},\"author\":{\"name\":\"Jordi Sala\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#\\\/schema\\\/person\\\/9e7088b9a88f62117d466d94479b2375\"},\"headline\":\"Vulnerabilidad cr\u00edtica en el plugin Really Simple Security de WordPress\",\"datePublished\":\"2024-11-19T14:50:25+00:00\",\"dateModified\":\"2026-09-08T10:53:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\\\/\"},\"wordCount\":274,\"publisher\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#organization\"},\"keywords\":[\"Vulnerabilidad\",\"WordPress\"],\"articleSection\":[\"Alertas de seguridad\"],\"inLanguage\":\"ca\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\\\/\",\"url\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\\\/\",\"name\":\"Vulnerabilidad cr\u00edtica en el plugin Really Simple Security de Wordpress - INFORDISA \\\/ Security Operations Center\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#website\"},\"datePublished\":\"2024-11-19T14:50:25+00:00\",\"dateModified\":\"2026-09-08T10:53:55+00:00\",\"description\":\"Esta vulnerabilidad permite a los atacantes no autentificados que inicien sesi\u00f3n como cualquier otro usuario existente de WordPress.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\\\/#breadcrumb\"},\"inLanguage\":\"ca\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Vulnerabilidad cr\u00edtica en el plugin Really Simple Security de WordPress\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#website\",\"url\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/\",\"name\":\"INFORDISA \\\/ Security Operations Center\",\"description\":\"Portal de Ciberseguridad\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ca\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#organization\",\"name\":\"INFORDISA \\\/ Security Operations Center\",\"url\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ca\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/logo-securityoperationscenter.png\",\"contentUrl\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/logo-securityoperationscenter.png\",\"width\":400,\"height\":34,\"caption\":\"INFORDISA \\\/ Security Operations Center\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/infordisa\\\/\",\"https:\\\/\\\/x.com\\\/infordisa\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/infordisa\",\"https:\\\/\\\/www.youtube.com\\\/user\\\/InfordisaTV\",\"https:\\\/\\\/www.instagram.com\\\/infordisa\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#\\\/schema\\\/person\\\/9e7088b9a88f62117d466d94479b2375\",\"name\":\"Jordi Sala\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ca\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g\",\"caption\":\"Jordi Sala\"},\"description\":\"Marketing\",\"sameAs\":[\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/\"],\"url\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/ca\\\/author\\\/jsala\\\/\"}]}<\/script>","yoast_head_json":{"title":"Vulnerabilitat cr\u00edtica al plugin Really Simple Security de Wordpress - INFORDISA \/ Security Operations Center","description":"Aquesta vulnerabilitat permet als atacants no autentificats que inici\u00efn sessi\u00f3 com qualsevol altre usuari existent de WordPress.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.infordisa.com\/soc\/ca\/vulnerabilitat-critica-plugin-really-simple-security-wordpress\/","og_locale":"ca_ES","og_type":"article","og_title":"Vulnerabilidad cr\u00edtica en el plugin Really Simple Security de Wordpress - INFORDISA \/ Security Operations Center","og_description":"Esta vulnerabilidad permite a los atacantes no autentificados que inicien sesi\u00f3n como cualquier otro usuario existente de WordPress.","og_url":"https:\/\/www.infordisa.com\/soc\/ca\/vulnerabilitat-critica-plugin-really-simple-security-wordpress\/","og_site_name":"INFORDISA \/ Security Operations Center","article_publisher":"https:\/\/www.facebook.com\/infordisa\/","article_published_time":"2024-11-19T14:50:25+00:00","article_modified_time":"2026-09-08T10:53:55+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.infordisa.com\/soc\/wp-content\/uploads\/2023\/07\/alerta-wordpress.jpg","type":"image\/jpeg"}],"author":"Jordi Sala","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.infordisa.com\/soc\/wp-content\/uploads\/2023\/07\/alerta-wordpress.jpg","twitter_creator":"@infordisa","twitter_site":"@infordisa","twitter_misc":{"Escrit per":"Jordi Sala","Temps estimat de lectura":"2 minuts"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\/#article","isPartOf":{"@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\/"},"author":{"name":"Jordi Sala","@id":"https:\/\/www.infordisa.com\/soc\/#\/schema\/person\/9e7088b9a88f62117d466d94479b2375"},"headline":"Vulnerabilidad cr\u00edtica en el plugin Really Simple Security de WordPress","datePublished":"2024-11-19T14:50:25+00:00","dateModified":"2026-09-08T10:53:55+00:00","mainEntityOfPage":{"@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\/"},"wordCount":274,"publisher":{"@id":"https:\/\/www.infordisa.com\/soc\/#organization"},"keywords":["Vulnerabilidad","WordPress"],"articleSection":["Alertas de seguridad"],"inLanguage":"ca"},{"@type":"WebPage","@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\/","url":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\/","name":"Vulnerabilitat cr\u00edtica al plugin Really Simple Security de Wordpress - INFORDISA \/ Security Operations Center","isPartOf":{"@id":"https:\/\/www.infordisa.com\/soc\/#website"},"datePublished":"2024-11-19T14:50:25+00:00","dateModified":"2026-09-08T10:53:55+00:00","description":"Aquesta vulnerabilitat permet als atacants no autentificats que inici\u00efn sessi\u00f3 com qualsevol altre usuari existent de WordPress.","breadcrumb":{"@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\/#breadcrumb"},"inLanguage":"ca","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-plugin-really-simple-security-wordpress\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/www.infordisa.com\/soc\/"},{"@type":"ListItem","position":2,"name":"Vulnerabilidad cr\u00edtica en el plugin Really Simple Security de WordPress"}]},{"@type":"WebSite","@id":"https:\/\/www.infordisa.com\/soc\/#website","url":"https:\/\/www.infordisa.com\/soc\/","name":"INFORDISA \/ Security Operations Center","description":"Portal de Ciberseguretat","publisher":{"@id":"https:\/\/www.infordisa.com\/soc\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.infordisa.com\/soc\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ca"},{"@type":"Organization","@id":"https:\/\/www.infordisa.com\/soc\/#organization","name":"INFORDISA \/ Security Operations Center","url":"https:\/\/www.infordisa.com\/soc\/","logo":{"@type":"ImageObject","inLanguage":"ca","@id":"https:\/\/www.infordisa.com\/soc\/#\/schema\/logo\/image\/","url":"https:\/\/www.infordisa.com\/soc\/wp-content\/uploads\/2021\/11\/logo-securityoperationscenter.png","contentUrl":"https:\/\/www.infordisa.com\/soc\/wp-content\/uploads\/2021\/11\/logo-securityoperationscenter.png","width":400,"height":34,"caption":"INFORDISA \/ Security Operations Center"},"image":{"@id":"https:\/\/www.infordisa.com\/soc\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/infordisa\/","https:\/\/x.com\/infordisa","https:\/\/www.linkedin.com\/company\/infordisa","https:\/\/www.youtube.com\/user\/InfordisaTV","https:\/\/www.instagram.com\/infordisa\/"]},{"@type":"Person","@id":"https:\/\/www.infordisa.com\/soc\/#\/schema\/person\/9e7088b9a88f62117d466d94479b2375","name":"Jordi Sala","image":{"@type":"ImageObject","inLanguage":"ca","@id":"https:\/\/secure.gravatar.com\/avatar\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g","caption":"Jordi Sala"},"description":"M\u00e0rqueting","sameAs":["https:\/\/www.infordisa.com\/soc\/"],"url":"https:\/\/www.infordisa.com\/soc\/ca\/author\/jsala\/"}]}},"_links":{"self":[{"href":"https:\/\/www.infordisa.com\/soc\/ca\/wp-json\/wp\/v2\/posts\/11412","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infordisa.com\/soc\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infordisa.com\/soc\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infordisa.com\/soc\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infordisa.com\/soc\/ca\/wp-json\/wp\/v2\/comments?post=11412"}],"version-history":[{"count":6,"href":"https:\/\/www.infordisa.com\/soc\/ca\/wp-json\/wp\/v2\/posts\/11412\/revisions"}],"predecessor-version":[{"id":14000,"href":"https:\/\/www.infordisa.com\/soc\/ca\/wp-json\/wp\/v2\/posts\/11412\/revisions\/14000"}],"wp:attachment":[{"href":"https:\/\/www.infordisa.com\/soc\/ca\/wp-json\/wp\/v2\/media?parent=11412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infordisa.com\/soc\/ca\/wp-json\/wp\/v2\/categories?post=11412"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infordisa.com\/soc\/ca\/wp-json\/wp\/v2\/tags?post=11412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}