EUVD-2026-47903
GHSA-wm9c-p6mf-fr7c
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
PR:H reflects mandatory WordPress admin access; I:L and A:L added because .htaccess is explicitly stated as writable, enabling redirect injection and denial-of-service beyond the read-only C:H impact.
Primary rating from Vendor (wordfence).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
The WP Encryption - One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Although file write content is passed through esc_html(), which encodes angle brackets and prevents direct PHP execution, plaintext configuration files such as .htaccess are fully writable and exploitable for denial-of-service or redirect attacks.
AnalysisAI
Directory traversal in the WP Encryption WordPress plugin (all versions through 7.8.6.6) allows authenticated administrators to read arbitrary server files via the unsanitized 'imploded' parameter in le_admin.php, potentially exposing credentials, API keys, and configuration secrets. Beyond file-read access, the plugin's write path sanitizes output only through esc_html() - which blocks PHP tag execution but leaves plaintext files such as .htaccess fully writable, opening a secondary path to denial-of-service or malicious redirect injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Wordfence has published an upstream changeset suggesting remediation is in progress.
Technical ContextAI
The vulnerability resides in le_admin.php within the WP Encryption plugin (WordPress.org slug: wp-letsencrypt-ssl), specifically at lines L150, L2120, and L2138 of the admin handler. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) describes the root cause: the 'imploded' parameter is passed to PHP filesystem functions without path canonicalization or restriction to a permitted directory, allowing traversal sequences (e.g., '../../') to escape the intended plugin directory and reach arbitrary server paths. The write-path sanitization relies on WordPress's esc_html() function, which HTML-encodes angle brackets and ampersands to prevent injected PHP tags from executing; however, esc_html() does not filter path traversal sequences or restrict plaintext content, leaving Apache configuration files such as .htaccess - which are interpreted as directives rather than PHP - fully writable and manipulable. No CPE string was provided in the available intelligence data; affected scope is defined by the WordPress plugin version range.
RemediationAI
An upstream code change at SVN revision 3617401 appears to address this vulnerability, as referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3617401%40wp-letsencrypt-ssl&new=3617401%40wp-letsencrypt-ssl; however, a specific patched plugin version number is not confirmed from the available data - administrators should verify the current release in the WordPress.org plugin repository and update to any version newer than 7.8.6.6 that incorporates this changeset. As an interim compensating control, restrict WordPress administrator role assignments to fully trusted individuals only, particularly in shared-hosting or multi-tenant environments where role grants are broader - this is the single most effective mitigation given the PR:H requirement. Disabling the plugin entirely until a confirmed patched version is available eliminates all exposure but removes SSL automation functionality. Deploying server-side file-integrity monitoring (e.g., inotify rules or a WordPress integrity plugin) on .htaccess and other sensitive configuration files can detect exploitation of the write path before damage propagates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today