CVE-2026-88798
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
Risk Assessment
An attacker can cause database bloat or slow down the site, potentially leading to denial of service for legitimate users.
Recommendation
Update the Really Simple Security plugin to version 9.8.3 or later, which includes the address validation fix.
Other vulnerabilities in Really Simple Security
See all- CVE-2026-82519Medium
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler.
- CVE-2026-81766Medium
The Really Simple Security WordPress plugin before 9.8.0 does not check if the user is allowed to install plugins, allowing a subsite administrator on a multisite network to install and execute arbitrary code in the network-shared plugin directory. Exploitation requires the network administrator to have enabled the plugin's administration menu for subsites, which is not the default.
Original NVD description (English source)
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS