EUVD-2026-69941
GHSA-7vhm-g3gx-jh4w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP requests to WordPress
-
ExploitTrigger unbounded resource allocation in Really Simple SSL handler
-
ExecutionExhaust PHP/server resource budget
-
ImpactDegrade site availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required and no special configuration or non-default setting is needed beyond having the Really Simple SSL plugin active on a WordPress site - any installation running version 9.8.0 or earlier with the plugin enabled is reachable via this vector. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms fully remote, zero-prerequisite access. What limits impact: the A:L (low) availability metric indicates partial, not complete, service disruption - a single request is unlikely to cause outage; sustained volumetric requests are needed. Well-provisioned hosting environments with existing rate limiting, CDN front-ends, or high PHP resource ceilings are likely to be less affected in practice. |
| Impact | CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects a low-complexity, unauthenticated, network-accessible DoS with limited availability impact - not a complete outage but a measurable degradation. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, keeping real-world urgency moderate. The A:L rating is important context: this is not a service-terminating exploit but rather a resource-pressure attack, meaning well-resourced hosting environments (CDN, WAF with rate limiting, or high-capacity hosting) may be practically unaffected. The primary risk is to small-to-medium WordPress deployments on shared hosting where resource limits are tight. EPSS data is not provided in the input; given the absence of KEV and POC, real-world exploitation probability is likely low. Priority should be moderate: patch promptly but not emergency-tier. |
| Exploit ScenarioDerived | An unauthenticated remote attacker repeatedly sends crafted HTTP requests to a WordPress site running Really Simple SSL 9.8.0 or earlier, targeting a resource-unbounded handler in the plugin. Each request causes the server to allocate disproportionate memory or processing without limit, progressively degrading response times or triggering PHP resource limits. No public exploit code exists at time of analysis, but the low attack complexity (AC:L, PR:N) means exploitation requires only scripted HTTP requests with no special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated denial of service against WordPress sites running Really Simple SSL plugin version 9.8.0 and earlier allows remote attackers to partially degrade site availability without any credentials. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the plugin fails to constrain resource consumption on certain request paths, enabling an attacker to send crafted requests that exhaust server resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS-assigned availability impact is rated Low, suggesting partial rather than complete service disruption.
RemediationAI
Update the Really Simple SSL plugin to a version beyond 9.8.0 as the immediate fix; the exact patched release version is not confirmed in the available input data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/really-simple-ssl/vulnerability/wordpress-really-simple-ssl-plugin-9-8-0-denial-of-service-attack-vulnerability and the WordPress plugin repository for the current release. As a compensating control prior to patching, deploying a Web Application Firewall or rate-limiting rule targeting the specific endpoint(s) exercised by this vulnerability (details available in the Patchstack writeup) will reduce exploitation surface without disabling SSL enforcement. WordPress-level rate limiting via plugins such as Wordfence or server-level throttling via nginx/Apache mod_evasive can also mitigate impact. These controls carry a trade-off: overly aggressive rate limiting may affect legitimate high-traffic sites.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Really Simple SSL (CPE: cpe:2.3:a:really_simple_plugins:really_simple_ssl:*:*:*:*:*:*:*:*) is a widely deployed WordPress plugin that automates HTTPS enforcement, manages SSL certificate detection, and handles HTTP-to-HTTPS redirects. CWE-770 (Allocation of Resources Without Limits or Throttling) indicates the plugin exposes at least one code path - likely a request handler or redirect-processing routine - that performs unbounded resource allocation (memory, connections, or compute) proportional to attacker-controlled input, without rate limiting or throttling. Because WordPress plugins process requests via PHP on shared or dedicated web server infrastructure, resource exhaustion in a plugin can degrade the entire WordPress instance rather than just the plugin subsystem.
Know when Really Simple Ssl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable, no auth, no user interaction required; impact is limited availability degradation only, no confidentiality or integrity effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Really Simple Ssl
View allAuthentication bypass in the Really Simple SSL WordPress plugin versions 9.5.10 and earlier allows remote attackers to c
Unauthenticated two-factor authentication bypass in the Really Simple SSL WordPress plugin (versions ≤9.8.0) allows a re
Broken access control in the Really Simple SSL WordPress plugin versions 9.5.9 and earlier permits any authenticated sub
Really Simple SSL versions 9.5.7 and earlier contain an authorization bypass flaw that allows unauthenticated remote att
Exploit-DB