EUVD-2026-82676
GHSA-43h4-q789-j3pr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Unauthenticated remote request with no interaction (AV:N/AC:L/PR:N/UI:N); unbounded option growth degrades but does not fully deny service, so A:L with C:N/I:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
AnalysisAI
Unauthenticated remote attackers can inflate a plugin option in the Really Simple Security WordPress plugin (versions 8.1.6 up to but not including 9.8.3) by supplying arbitrary address values that the plugin uses as storage keys without validation, causing unbounded option growth and slower handling of missing pages. The impact is availability-only degradation (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity effect, and default configurations are reachable by network unauthenticated exploitation as long as the site is online. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of the Really Simple Security WordPress plugin (versions 8.1.6 up to but not including 9.8.3). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-to-moderate real-world risk that is correctly rated: the vendor CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects an availability-only impact with no confidentiality or integrity effect, and I agree with it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update Really Simple Security to 9.8.3 or later, which is the only complete fix and is available from the vendor per the WPScan advisory at https://wpscan.com/vulnerability/e658dcd2-2ff6-4611-a28d-e2482c65be8b/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-88798. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Really Simple Security
View allThe Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass
Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attack
Two-factor authentication bypass in the Really Simple Security WordPress plugin before 9.5.10.1 allows attackers who alr
Improper privilege management in the Really Simple Security WordPress plugin before 9.8.0 permits a subsite administrato
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today