What is the CVSS score of CVE-2026-3829?

CVE-2026-3829 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

WP Encryption CVE-2026-3829

EUVD-2026-30228 MEDIUM

Missing Authorization (CWE-862)

2026-05-14 security@wordfence.com

GHSA-59q9-p5gj-c577

Authentication Bypass WordPress

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:54 vuln.today

CVE Published

May 14, 2026 - 06:16 nvd

MEDIUM 5.4

DescriptionCVE.org

The WP Encryption - One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'wple_basic_get_requests' function in all versions up to, and including, 7.8.5.10. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the SSL setup state, force SSL to appear complete, and modify plan selection options.

AnalysisAI

Missing authorization controls in the WP Encryption WordPress plugin (all versions through 7.8.5.10) allow any authenticated subscriber-level user to invoke the wple_basic_get_requests function and tamper with SSL lifecycle configuration - resetting SSL setup state, falsely marking SSL as complete, and altering plan selection options. The affected plugin automates Let's Encrypt certificate provisioning for WordPress sites, meaning successful exploitation can silently break or misrepresent a site's HTTPS posture. No public exploit code exists and no active exploitation is confirmed (not in CISA KEV); EPSS at 0.02% and SSVC exploitation rating of 'none' place this firmly in the low-urgency tier despite the low privilege bar.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization): the wple_basic_get_requests function in le_admin.php and le_handlers.php executes privileged SSL administrative actions without invoking WordPress capability checks (e.g., current_user_can()). WordPress's role-and-capability model is the intended gating mechanism - subscriber is the lowest authenticated role and should have no administrative rights over plugin state. The plugin (repository slug: wp-letsencrypt-ssl) wraps Let's Encrypt's ACME protocol to automate certificate issuance and renewal; its internal state machine tracks setup progress and plan tier. By bypassing authorization, an attacker can manipulate this state machine without holding administrator or editor capabilities. The two Trac changesets provided in the NVD references pinpoint the exact files modified in the 7.8.5.11 fix, confirming the vulnerability is scoped to those two admin-side handler files.

RemediationAI

Update the WP Encryption plugin to version 7.8.5.11 or later through the WordPress admin dashboard or via WP-CLI (wp plugin update wp-letsencrypt-ssl); this version is confirmed to patch the missing capability checks in both le_admin.php and le_handlers.php per the Trac changesets at https://plugins.trac.wordpress.org/changeset?old_path=wp-letsencrypt-ssl/tags/7.8.5.10/admin/le_admin.php&new_path=wp-letsencrypt-ssl/tags/7.8.5.11/admin/le_admin.php. If immediate patching is not possible, disable open user registration (Settings → General → uncheck 'Anyone can register') to eliminate the subscriber-level attack surface from untrusted parties - note this impacts legitimate registration flows. Alternatively, a WordPress WAF such as Wordfence can be configured to block unauthenticated and low-privilege AJAX requests targeting the wple_basic_get_requests action; be aware this may interfere with legitimate plugin operation for admins if misconfigured. The NVD advisory is at https://nvd.nist.gov/vuln/detail/CVE-2026-3829.