CVE-2026-108064

Deferred Deferred - Pending Action

Unauthenticated Certificate Key Overwrite in WP Encryption Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108064

EUVD

EUVD-2026-100848

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	WP	Encryption 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The WP Encryption WordPress plugin before version 7.8.8.2 has a vulnerability where an unauthenticated user can exploit a missing capability or nonce check in the SSL certificate-provisioning routine. This allows them to overwrite the site's SSL certificate private key and replace pending Let's Encrypt order and challenge materials with a single request. Repeated requests prevent administrators from completing certificate issuance.

Detection Guidance

Check if the WP Encryption plugin version is below 7.8.8.2 by inspecting the plugin files or WordPress admin panel. Look for unauthorized modifications to SSL certificate files or Let's Encrypt challenge materials in the plugin's directory.

Impact Analysis

This vulnerability allows attackers to disrupt SSL certificate issuance for your WordPress site. They can overwrite your private key and challenge materials, preventing you from securing your site with HTTPS. This could lead to downtime, loss of trust, and potential exposure of sensitive data transmitted to your site.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by exposing data in transit due to the lack of HTTPS. GDPR requires protection of personal data, and HIPAA mandates encryption for protected health information. Failure to secure the site with HTTPS may result in non-compliance and potential legal consequences.

Mitigation Strategies

Update the WP Encryption plugin to version 7.8.8.2 or later immediately. If updating is not possible, consider disabling the plugin temporarily until the update is applied. Review SSL certificate files and Let's Encrypt order materials for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-108064. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70