Really Simple Security, formerly known as Really Simple SSL, has released version 9.8.4 with an important permission fix for WordPress Multisite installations.
The update, published on October 26, 2026, restricts network-wide plugin deactivation to network administrators. It follows several security-related releases that addressed two-factor authentication (2FA) bypasses and other vulnerabilities.
If you use Really Simple Security on a single WordPress site or manage a multisite network, here’s what the latest update means and how to install it safely.
Really Simple Security 9.8.4: Update Summary
| Detail | Information |
|---|---|
| Plugin | Really Simple Security |
| Latest version | 9.8.4 |
| Release date | October 26, 2026 |
| Main change | Multisite deactivation permission fix |
| Affected functionality | Network-wide plugin deactivation |
| Previous security fixes | 2FA bypasses and database growth |
| New CVE for 9.8.4 | Not identified in the changelog |
| Active exploitation | Not established by the release notes |
1. What Changed in Really Simple Security 9.8.4?
WordPress Multisite allows administrators to manage multiple websites from one network.
Network administrators have broader permissions than administrators responsible for individual subsites. Network-wide plugin changes should therefore remain under network-level control.
Version 9.8.4 adds a security restriction ensuring that only network administrators can deactivate Really Simple Security across the entire network.
This is particularly relevant for agencies, hosting providers, and organizations running multiple WordPress websites.
The change does not mean every single-site installation was vulnerable to a newly disclosed critical attack. The official changelog does not assign a CVE to this release or confirm active exploitation.
2. Earlier Security Fixes in Versions 9.8.0–9.8.3
The latest release follows several earlier security updates.
| Version | Date | Main Changes |
|---|---|---|
| 9.8.0 | August 25, 2026 | Compatibility fixes and 2FA grace-period improvements |
| 9.8.1 | September 1, 2026 | Fixed security issues involving 2FA status and XML-RPC authentication |
| 9.8.2 | September 14, 2026 | Fixed a 2FA grace-period issue and related errors |
| 9.8.3 | September 15, 2026 | Fixed a remaining XML-RPC 2FA bypass and unauthenticated database-growth issue |
| 9.8.4 | October 26, 2026 | Restricted network-wide deactivation to network administrators |
These are separate fixes, not one vulnerability carried across all five releases.
Security databases also document earlier vulnerabilities affecting versions before the corresponding patches. Websites running older releases should therefore update rather than relying on only the newest permission change.
3. Who Should Update?
All users should consider installing the latest compatible release, but the Multisite permission fix is especially relevant to network administrators.
You should prioritize updating if:
- You manage a WordPress Multisite network.
- Subsite administrators have access to plugin-management screens.
- You use Really Simple Security for 2FA or login protection.
- Your installation is still running a version earlier than 9.8.4.
Even if you run a standard single-site installation, keeping the plugin updated helps ensure you receive previous security fixes.
4. How to Update Really Simple Security Safely
Follow these steps to upgrade your website.
Step 1: Back up your website.
Create a recent backup of your database and WordPress files. Store a copy outside your hosting account.
Step 2: Check your current version.
Open Plugins → Installed Plugins and locate Really Simple Security.
Step 3: Update the plugin.
Navigate to Dashboard → Updates or use the update option beside the plugin. Install version 9.8.4 or a newer verified release.
Step 4: Check your security settings.
Review two-factor authentication, login protection, SSL configuration, and firewall settings.
Step 5: Test your website.
Confirm that the WordPress dashboard, login process, and important website functions work correctly.
Step 6: Verify Multisite permissions.
If you operate a network, confirm that only authorized network administrators can perform network-wide plugin actions.
If you manage multiple client websites, repeat these checks across each installation.
5. Additional WordPress Security Recommendations
A plugin update is only one part of website protection.
Use strong administrator passwords, enable 2FA, remove unused accounts, and keep WordPress core, themes, and plugins updated.
For Multisite installations, assign the minimum necessary permissions to subsite administrators.
Maintain independent backups and test restoration periodically. If you suspect unauthorized access, investigate administrator accounts and server logs rather than assuming an update alone resolves the problem.
Frequently Asked Questions
When was Really Simple Security 9.8.4 released?
The official WordPress.org changelog lists October 26, 2026.
What does version 9.8.4 fix?
It restricts network-wide deactivation of the plugin to network administrators on WordPress Multisite.
Does version 9.8.4 fix earlier 2FA vulnerabilities?
The 2FA fixes were introduced in earlier releases, particularly versions 9.8.1–9.8.3. Updating to 9.8.4 includes those earlier fixes.
Is active exploitation confirmed?
The official 9.8.4 release note does not establish active exploitation or identify a new CVE.
Final Verdict
The Really Simple Security 9.8.4 update strengthens permission handling for WordPress Multisite administrators. It follows earlier releases that addressed more serious authentication and database-related security issues.
Update to the latest compatible version, verify your login protections, and review permissions across your network.
For more WordPress security news, plugin updates, and practical website protection guides, visit GPLNESTS.COM.
