Unvalidated Input in Really Simple Security Plugin by WordPress
CVE-2026-88798
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 18 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-88798?
The Really Simple Security plugin for WordPress, prior to version 9.8.3, contains a vulnerability that allows unauthenticated attackers to exploit unvalidated input. By providing a client-supplied address value as a storage key, an attacker can manipulate the plugin's functionality, leading to excessive growth of storage options. This ultimately degrades the site's performance and can create significant delays in handling requests for missing pages.
Affected Version(s)
Really Simple Security 8.1.6 < 9.8.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.