Really Simple Security EUVD-2026-82676

No special conditions - remote unauthenticated exploitation against default configurations of the Really Simple Security WordPress plugin (versions 8.1.6 up to but not including 9.8.3). The attacker only needs network reachability to the site; the vulnerable option-key storage is part of the plugin's normal request handling, so no authentication, user interaction, or non-default setting is required. The practical limit on impact is that the outcome is gradual availability degradation (slower missing-page/404 handling and unbounded option growth) rather than a complete outage or any data compromise, and sites not running this plugin (or already on 9.8.3+) are unaffected.

This is a low-to-moderate real-world risk that is correctly rated: the vendor CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects an availability-only impact with no confidentiality or integrity effect, and I agree with it. CWE-400 (uncontrolled resource consumption) matches the description: an unauthenticated attacker supplies an unvalidated client address that is used as a storage key in one of the plugin's own options, allowing that option row to grow without bound and slowing the site's handling of missing (404) pages. The A:L (not A:H) is appropriate - the described effect is degraded performance of missing-page handling and option bloat, not a full site outage. A public POC exists (WPScan) and a patch is available in 9.8.3, but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation in the provided data - so this is 'exploit code exists' rather than 'exploited.' Because the payoff is only gradual performance degradation / database bloat rather than data theft or code execution, this is a patch-in-normal-cycle item, not an emergency, despite the large install base of the plugin. No signals conflict; the main missing signals are EPSS and any exploitation telemetry.

An unauthenticated attacker sends a stream of HTTP requests to the target WordPress site, each carrying a distinct crafted client-supplied address value that Really Simple Security stores verbatim as a key inside one of its own options. Repeated requests grow that option row without bound, bloating the database and progressively slowing the site's handling of missing/404 pages. A public proof-of-concept is available via WPScan, and no authentication or user interaction is required.