blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-108064

MEDIUM 6.5 CVSS 3.1
Published
October 14, 2026
Last modified
October 14, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Description

The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.

Affected WordPress components

  • WP Encryption – One Click SSL / HTTPS & Free SSL Certificate, HTTPS Redirect, Security Plugin · wp-letsencrypt-ssl
    Confirmed match Active
    Before 7.8.8.2
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown WP Encryption — Before 7.8.8.2

References

  • wpscan.com https://wpscan.com/vulnerability/5657137d-f496-43f7-9067-e05b99c36006/
  • nvd.nist.gov Official NVD record