5.3
Medium
CVE-2026-88798 The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using…
Description
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Really Simple Security 8.1 | 8.1.6 → < 9.8.3 | 9.8.3 |
Other CVEs of Really Simple Security
The 4 CVEs of Really Simple Security →
CVE-2026-89080
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting…
7.5
High
CVE-2026-81766
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really…
6.6
Medium
CVE-2026-8293
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of…
7.5
High