Critical WordPress Plug-in Flaw Exposes 4M Sites to Takeover

A vulnerability found in the Really Simple Security plug-in allows an attacker to remotely gain access to any account on an affected website, including the administrator, when 2FA is enabled.