Wp Encryption
Monthly
Unauthenticated attackers can interfere with SSL certificate provisioning in the WP Encryption WordPress plugin versions before 7.8.8.2 by hitting a handler that performs neither a capability check nor a nonce check. A single request lets an attacker overwrite the site's certificate private key and replace the pending Let's Encrypt order and challenge material; repeated requests keep regenerating that material so the administrator can never complete issuance, resulting in a persistent denial of the certificate-provisioning workflow. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) confirms remote, unauthenticated exploitation with low integrity and availability impact and no confidentiality loss; publicly available exploit code exists according to WPScan, but there is no evidence of active exploitation and EPSS is low at 0.12% (2nd percentile). Exposure is limited to internet-reachable sites running the vulnerable plugin while an administrator is attempting Let's Encrypt issuance through it.
Unauthenticated attackers can interfere with SSL certificate provisioning in the WP Encryption WordPress plugin versions before 7.8.8.2 by hitting a handler that performs neither a capability check nor a nonce check. A single request lets an attacker overwrite the site's certificate private key and replace the pending Let's Encrypt order and challenge material; repeated requests keep regenerating that material so the administrator can never complete issuance, resulting in a persistent denial of the certificate-provisioning workflow. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) confirms remote, unauthenticated exploitation with low integrity and availability impact and no confidentiality loss; publicly available exploit code exists according to WPScan, but there is no evidence of active exploitation and EPSS is low at 0.12% (2nd percentile). Exposure is limited to internet-reachable sites running the vulnerable plugin while an administrator is attempting Let's Encrypt issuance through it.