CVE-2026-108064CWE-862broken-access-control

CVE-2026-108064

Medium · published October 14, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-14T11:17Z
References (1)
https://wpscan.com/vulnerability/5657137d-f496-43f7-9067-e05b99c36006/ · [email protected]
EPSS history
Timeline
  • 15 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 14 OCT 06:00Z
    WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler
    cvelistv5
  • 14 OCT 06:00Z
    WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler
    cvelistv5