Vulnerability in WP Encryption Plugin Allows Unauthorized Certificate Overwriting
CVE-2026-108064
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 14 October 2026
Badges
What is CVE-2026-108064?
The WP Encryption plugin for WordPress versions prior to 7.8.8.2 is susceptible to improper authentication vulnerabilities, where it fails to implement necessary capability or nonce checks on its SSL certificate provisioning handlers. This allows unauthenticated users to potentially overwrite the site's SSL certificate private key and disrupt the certificate issuance process. By sending repeated requests, an attacker can regenerate the site's pending Let's Encrypt order material, preventing the legitimate administrator from successfully completing the SSL certificate issuance, thus exposing the site to various security risks.
Affected Version(s)
WP Encryption 0 < 7.8.8.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.