PT-2026-40865 · Gowebsmarty · Wp Encryption – One Click Free Ssl Certificate & Ssl / Https Redirect

Kitch Global · Publicado 2026-05-14 · Atualizado 2026-05-14 · CVE-2026-3829

Mitre

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'wple basic get requests' function in all versions up to, and including, 7.8.5.10. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the SSL setup state, force SSL to appear complete, and modify plan selection options.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-3829

Produtos afetados

Wp Encryption – One Click Free Ssl Certificate & Ssl / Https Redirect

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-3829 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?old_path=wp-letsencrypt-ssl/tags/7.8.5.10/admin/le_admin.php&new_path=wp-letsencrypt-ssl/tags/7.8.5.11/admin/le_admin.php · Nota
• https://plugins.trac.wordpress.org/changeset?old_path=wp-letsencrypt-ssl/tags/7.8.5.10/admin/le_handlers.php&new_path=wp-letsencrypt-ssl/tags/7.8.5.11/admin/le_handlers.php · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/9a09ec65-32e4-4841-a365-f67c15b80bf9?source=cve · Nota