CVE-2026-27397: 
WordPress vulnerability analysis and mitigation

CVE-2026-27397 is an Authorization Bypass Through User-Controlled Key (IDOR) vulnerability in the Really Simple Security Pro WordPress plugin by Really Simple Plugins B.V. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability affects Really Simple Security Pro versions up to and including 9.5.4.0. It was published on March 19, 2026, with a CVSS v3.1 base score of 6.5 (Medium/High) (Feedly, EUVD).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). An attacker can manipulate user-controlled keys or identifiers in requests to bypass access control checks and interact with resources or objects they are not authorized to access. The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it straightforward to exploit over the network (Feedly, Patchstack).

Successful exploitation results in limited but meaningful impacts to both integrity and availability, with no confidentiality impact per the CVSS scoring. An unauthenticated attacker could manipulate or delete data objects they should not have access to, and cause limited disruption to availability of affected resources. The scope is unchanged, meaning the impact is confined to the vulnerable plugin's functionality within the WordPress installation (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability was assigned and disclosed by Patchstack (Feedly, EUVD).

Users should update Really Simple Security Pro to a version beyond 9.5.4.0, as all versions up to and including 9.5.4.0 are affected. Check the plugin's official changelog or the WordPress plugin repository for the patched release. As a general precaution, restrict access to WordPress admin endpoints and monitor for unexpected changes to plugin-managed security settings (Patchstack).

The vulnerability was discovered and reported by Patchstack, a WordPress security platform, and has been tracked in the EU Vulnerability Database (EUVD-2026-13055). Social media activity appears minimal, with only automated CVE notification posts observed on platforms such as Bluesky. No notable researcher commentary or significant media coverage has been identified beyond standard vulnerability database aggregation (EUVD).