CVE-2026-108064
WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler
- State
- Published
- Severity
- 6.5 Medium
- Published
- Oct 14, 2026
- Updated
- Oct 14, 2026
- Reserved
- Oct 9, 2026
Description
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
WP EncryptionUnknown |
|
References
- https://wpscan.com/vulnerability/5657137d-f496-43f7-9067-e05b99c36006/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.