CVE-2026-88798

Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.

Affected

Really Simple Security

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2026-09-18

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e658dcd2-2ff6-4611-a28d-e2482c65be8b/

References

• CVE Record
• NVD entry