EUVD-2026-100848
GHSA-x5q6-8482-f3j8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
DeliverySend request to unprotected handler
-
ExploitOverwrite private key and reset Let's Encrypt order
-
ExecutionRepeat to regenerate challenge material
-
ImpactBlock certificate issuance (persistent DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the WP Encryption plugin (version before 7.8.8.2) installed and active on an internet-reachable WordPress site: one of its SSL certificate-provisioning handlers lacks both a capability check and a nonce check, so remote unauthenticated requests to that handler succeed against default installations. The practical precondition is that the administrator is in the middle of (or attempting) Let's Encrypt certificate issuance via this plugin - the attack's impact is to overwrite the private key and repeatedly reset the pending order/challenge, preventing issuance. Limiting factors: impact is confined to SSL certificate provisioning (no confidentiality loss, no RCE), and sites already serving a valid certificate or not using the plugin's Let's Encrypt flow are less affected. |
| Impact | This is a moderate, functionally-scoped issue rather than a top-tier emergency. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, 6.5) and the CWE-862 (missing authorization) root cause align well with the description: a network-reachable, low-complexity, unauthenticated request with no confidentiality impact and only low integrity and availability impact. All signals agree that this is NOT a code-execution or data-disclosure flaw - it corrupts the plugin's Let's Encrypt provisioning state (private key, pending order, challenge material). EPSS is very low (0.12%, 2nd percentile) and SSVC lists Exploitation=none, so despite a publicly available POC there is no evidence of active exploitation; the POC and SSVC Automatable=yes indicate it is easy and scriptable to abuse, but real-world targeting appears speculative at this time. It is NOT in CISA KEV. Net: a genuine unauthenticated authorization-bypass worth patching promptly on affected sites, but the capped Integrity/Availability impact (effectively a persistent denial of SSL certificate issuance plus private-key overwrite, not full site compromise) keeps it below critical priority. Note one nuance to verify: the 'Authentication Bypass' tag overstates the issue - this is a missing capability/nonce (authorization) check, not an authentication bypass. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a single crafted request to the unprotected certificate-provisioning handler, causing the plugin to overwrite the site's certificate private key and reset the pending Let's Encrypt order and challenge material. By repeating the request on a schedule, the attacker continuously regenerates this material so the administrator can never complete certificate issuance, resulting in a persistent SSL-provisioning denial of service. A public POC exists (published by WPScan), lowering the barrier to abuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Unauthenticated attackers can interfere with SSL certificate provisioning in the WP Encryption WordPress plugin versions before 7.8.8.2 by hitting a handler that performs neither a capability check nor a nonce check. A single request lets an attacker overwrite the site's certificate private key and replace the pending Let's Encrypt order and challenge material; repeated requests keep regenerating that material so the administrator can never complete issuance, resulting in a persistent denial of the certificate-provisioning workflow. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) confirms remote, unauthenticated exploitation with low integrity and availability impact and no confidentiality loss; publicly available exploit code exists according to WPScan, but there is no evidence of active exploitation and EPSS is low at 0.12% (2nd percentile). Exposure is limited to internet-reachable sites running the vulnerable plugin while an administrator is attempting Let's Encrypt issuance through it.
RemediationAI
Upgrade WP Encryption to version 7.8.8.2 or later, which is the vendor-released fix for this missing-authorization flaw; verify the installed version from the WordPress Plugins screen or with WP-CLI (wp plugin get wp-encryption --field=version) and update through the WordPress dashboard or wp plugin update wp-encryption. If an immediate update is not possible, the most effective compensating control is to deactivate the plugin until patching can be performed, accepting the loss of its certificate-management features (certificates already issued and installed on the web server continue to function independently of the plugin). Where the plugin must remain active, restrict access to the plugin's admin-ajax/plugin endpoints at the web server or WAF so that unauthenticated requests targeting the certificate-provisioning action are blocked, and treat any in-progress Let's Encrypt issuance as compromised: after patching, revoke the affected certificate, delete the plugin's stored key/order material, and regenerate it before retrying issuance, since an attacker may have overwritten the private key and challenge data. Note that blocking admin-ajax.php broadly can break other legitimate front-end plugin functionality, so scope rules to the specific action parameter. Additional details and the original disclosure are available at the WPScan advisory https://wpscan.com/vulnerability/5657137d-f496-43f7-9067-e05b99c36006/ and the NVD record https://nvd.nist.gov/vuln/detail/CVE-2026-108064; there is no vendor-released standalone patch beyond the version bump, and since public exploit code exists, prioritization should account for any site actively attempting certificate issuance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WP Encryption is a WordPress plugin that automates issuance and installation of free SSL/TLS certificates via Let's Encrypt, generating a private key, a certificate signing request, and an ACME order with associated HTTP-01 or DNS-01 challenge material that must remain stable and verifiable during validation. The root cause is CWE-862 (Missing Authorization): one of the AJAX/REST handlers driving the certificate-provisioning routine registers a callback without a current_user_can() capability check and without a check_ajax_referer()/wp_verify_nonce() nonce check, so any unauthenticated HTTP client that knows the action name can invoke it. Because the handler also performs no state validation, it accepts attacker-supplied or attacker-triggered regeneration of the private key and ACME order data, overwriting the legitimate pending material in the plugin's options/storage. The CPE string is generic (unknown:wp_encryption) and the ENISA EUVD record lists affected range as WP Encryption 0 through <7.8.8.2, matching the description. The impact class is integrity and availability of the certificate-provisioning workflow rather than code execution or data disclosure - the SSVC assessment rates technical impact as partial, automatable as yes, and exploitation as none, which is consistent with a scriptable, repeatable but functionally bounded attack.
Know when Wp Encryption gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Missing authorization on a network handler gives AV:N/AC:L/PR:N/UI:N; overwriting key/order material is I:L and blocking issuance is A:L, with no data disclosure so C:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB