What the vulnerability does
01Description
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'wple_basic_get_requests' function in all versions up to, and including, 7.8.5.10. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the SSL setup state, force SSL to appear complete, and modify plan selection options.
Explanation of Vulnerability in Simple Terms
02Summary
The WP Encryption plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify site data without proper permission checks. An attacker with a basic user account can alter settings or content, potentially affecting site integrity. Update to a version newer than 7.8.5.10 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify site data or settings without proper authorization as a low-privilege authenticated user.
Potential impact on your site
04Site Impact
Unauthorized changes to site configuration or content by users who should not have those permissions.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with low-level privileges (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
May 14, 2026
CVE published
May 14, 2026
Record updated
