Executive brief
Really Simple Security is a popular WordPress plugin that helps protect WordPress sites from security threats. The plugin fails to properly validate client IP addresses before storing them, allowing attackers to repeatedly submit fake IP addresses that accumulate in the site's database. This causes the site to slow down significantly when handling requests for missing pages, potentially making the site unavailable to legitimate visitors.
Technical details
The vulnerability is an unbounded option growth denial of service (DoS) caused by insufficient input validation. The plugin uses client-supplied address values (such as IP headers) directly as storage keys in WordPress options without validation or sanitization. An unauthenticated attacker can exploit this by sending requests with varying spoofed IP addresses, causing the plugin to create new entries without limit. This is a network-based attack requiring no authentication or user interaction. The result is resource exhaustion as the option grows without bounds, degrading the site's performance when processing 404 requests. Fixed in version 9.8.3.
Affected products
- Really Simple Security Really Simple Security before 9.8.3
Timeline
- 2026-09-18: disclosed: Published on NVD
- 2026-09-16: advisory: Publicly published on WPScan
- 2026-09-18: patched: Fixed in version 9.8.3