CVE-2026-88798
UnknownSummary
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
Risk Assessment
An attacker can cause database bloat or slow down the site, potentially leading to denial of service for legitimate users.
Recommendation
Update the Really Simple Security plugin to version 9.8.3 or later, which includes the address validation fix.
Other vulnerabilities in Really Simple Security
See all- CVE-2026-82519Medium
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler.
- CVE-2026-81766Medium
The Really Simple Security WordPress plugin before 9.8.0 does not check if the user is allowed to install plugins, allowing a subsite administrator on a multisite network to install and execute arbitrary code in the network-shared plugin directory. Exploitation requires the network administrator to have enabled the plugin's administration menu for subsites, which is not the default.
Original NVD description (English source)
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.