Directory Traversal Vulnerability in WP Encryption Plugin for WordPress

CVE-2026-15786

What is CVE-2026-15786?

The WP Encryption plugin, which provides functionalities for free SSL certificates and HTTPS redirection, is exposed to a directory traversal vulnerability in versions up to and including 7.8.6.6. This flaw arises from improper handling of the 'imploded' parameter, allowing authenticated attackers with administrator-level access to read arbitrary files on the server. Although output sanitization via esc_html() mitigates direct PHP execution through file writes, attackers can exploit writable configuration files, such as .htaccess, leading to potential denial-of-service conditions or redirect attacks that compromise website security.

References