CVE-2026-88798

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.

Score

CVSS 3.1 5.3 Medium

Status

Deferred - contact@wpscan.com

Published

2026-09-18

Last modified

2026-09-18

Weaknesses

CWE-400

Affected products

• Really Simple Security (Unknown)

References

• https://wpscan.com/vulnerability/e658dcd2-2ff6-4611-a28d-e2482c65be8b/