CVE-2026-88798: Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header
Published Sep 18, 2026
·Updated
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
Affected Software
1 affected component
Really Simple Security Really Simple Security (Free)<9.8.3
Event History
Sep 18, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker can exploit it. The issue affects Really Simple Security (Free) versions before 9.8.3.
2
What does an attacker need to do?
The attacker needs to supply spoofed client IP address values that the plugin uses as storage keys. Repeated unique values can cause the relevant option to grow without bound.
3
What is the operational impact?
Growth of the plugin option can degrade site performance, particularly by slowing the handling of missing-page requests.