EUVD-2026-69941
GHSA-7vhm-g3gx-jh4w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable, no auth, no user interaction required; impact is limited availability degradation only, no confidentiality or integrity effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.
AnalysisAI
Unauthenticated denial of service against WordPress sites running Really Simple SSL plugin version 9.8.0 and earlier allows remote attackers to partially degrade site availability without any credentials. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the plugin fails to constrain resource consumption on certain request paths, enabling an attacker to send crafted requests that exhaust server resources. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required and no special configuration or non-default setting is needed beyond having the Really Simple SSL plugin active on a WordPress site - any installation running version 9.8.0 or earlier with the plugin enabled is reachable via this vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects a low-complexity, unauthenticated, network-accessible DoS with limited availability impact - not a complete outage but a measurable degradation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Really Simple SSL plugin to a version beyond 9.8.0 as the immediate fix; the exact patched release version is not confirmed in the available input data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/really-simple-ssl/vulnerability/wordpress-really-simple-ssl-plugin-9-8-0-denial-of-service-attack-vulnerability and the WordPress plugin repository for the current release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Really Simple Ssl
View allAuthentication bypass in the Really Simple SSL WordPress plugin versions 9.5.10 and earlier allows remote attackers to c
Unauthenticated two-factor authentication bypass in the Really Simple SSL WordPress plugin (versions ≤9.8.0) allows a re
Broken access control in the Really Simple SSL WordPress plugin versions 9.5.9 and earlier permits any authenticated sub
Really Simple SSL versions 9.5.7 and earlier contain an authorization bypass flaw that allows unauthenticated remote att
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today