Executive brief
A vulnerability in the WP Encryption plugin for WordPress allows low-level users, such as subscribers, to interfere with the website's security settings. An attacker could reset the SSL certificate setup process or manipulate subscription plan options. This could lead to service disruptions or administrative confusion regarding the site's encryption status.
Technical details
The vulnerability is classified as Missing Authorization (CWE-862) within the 'wple_basic_get_requests' function of the WP Encryption plugin. Because the function lacks proper capability checks, any authenticated user with at least subscriber-level permissions can trigger administrative actions via network requests. Specifically, an attacker can reset the SSL setup state, bypass completion checks to make SSL appear fully configured when it is not, and modify internal plan selection options. The issue is resolved in version 7.8.5.11.
Affected products
- WP Encryption WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan Up to, and including, 7.8.5.10
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory
References
- https://plugins.trac.wordpress.org/changeset?old_path=wp-letsencrypt-ssl/tags/7.8.5.10/admin/le_admin.php&new_path=wp-letsencrypt-ssl/tags/7.8.5.11/admin/le_admin.php
- https://plugins.trac.wordpress.org/changeset?old_path=wp-letsencrypt-ssl/tags/7.8.5.10/admin/le_handlers.php&new_path=wp-letsencrypt-ssl/tags/7.8.5.11/admin/le_handlers.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9a09ec65-32e4-4841-a365-f67c15b80bf9?source=cve