Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-88798

Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88798

Published

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88798

Published

Really Simple Security

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Really Simple Security",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "8.1.6",
                            "lessThan": "9.8.3"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON