CVE-2026-15786 (GCVE-0-2026-15786)
Vulnerability from cvelistv5 – Published: 2026-07-23 09:33 – Updated: 2026-07-24 22:39
VLAI
EPSS
VEX
Title
WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter
Summary
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Although file write content is passed through esc_html(), which encodes angle brackets and prevents direct PHP execution, plaintext configuration files such as .htaccess are fully writable and exploitable for denial-of-service or redirect attacks. This is only exploitable when the premium version of the software is enabled and active.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| gowebsmarty | WP Encryption – Lifetime Free SSL Cert & HTTPS, Force SSL / HTTPS Redirect, SSL Security |
Affected:
0 , ≤ 7.8.6.6
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15786",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T13:37:41.149532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T13:37:50.416Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Encryption \u2013 Lifetime Free SSL Cert \u0026 HTTPS, Force SSL / HTTPS Redirect, SSL Security",
"vendor": "gowebsmarty",
"versions": [
{
"lessThanOrEqual": "7.8.6.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Encryption \u2013 One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect, Security \u0026 SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the \u0027imploded\u0027 parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Although file write content is passed through esc_html(), which encodes angle brackets and prevents direct PHP execution, plaintext configuration files such as .htaccess are fully writable and exploitable for denial-of-service or redirect attacks. This is only exploitable when the premium version of the software is enabled and active."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T22:39:47.800Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee86d33-5a1e-4dc5-b2f6-0beffd8a6b2e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-letsencrypt-ssl/tags/7.8.6.6/admin/le_admin.php#L2138"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-letsencrypt-ssl/tags/7.8.6.6/admin/le_admin.php#L2120"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-letsencrypt-ssl/tags/7.8.6.6/admin/le_admin.php#L150"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3617401%40wp-letsencrypt-ssl\u0026new=3617401%40wp-letsencrypt-ssl"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-22T07:16:48.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-22T20:35:43.000Z",
"value": "Disclosed"
}
],
"title": "WP Encryption \u003c= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via \u0027imploded\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15786",
"datePublished": "2026-07-23T09:33:57.567Z",
"dateReserved": "2026-07-14T19:18:05.209Z",
"dateUpdated": "2026-07-24T22:39:47.800Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-15786",
"date": "2026-07-25",
"epss": "0.0041",
"percentile": "0.33544"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-15786\",\"sourceIdentifier\":\"security@wordfence.com\",\"published\":\"2026-07-23T10:16:51.207\",\"lastModified\":\"2026-07-24T23:16:50.087\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The WP Encryption \u2013 One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect, Security \u0026 SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the \u0027imploded\u0027 parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Although file write content is passed through esc_html(), which encodes angle brackets and prevents direct PHP execution, plaintext configuration files such as .htaccess are fully writable and exploitable for denial-of-service or redirect attacks. This is only exploitable when the premium version of the software is enabled and active.\"}],\"affected\":[{\"source\":\"security@wordfence.com\",\"affectedData\":[{\"vendor\":\"gowebsmarty\",\"product\":\"WP Encryption \u2013 Lifetime Free SSL Cert \u0026 HTTPS, Force SSL / HTTPS Redirect, SSL Security\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"7.8.6.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@wordfence.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.7,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-23T13:37:41.149532Z\",\"id\":\"CVE-2026-15786\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@wordfence.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://plugins.trac.wordpress.org/browser/wp-letsencrypt-ssl/tags/7.8.6.6/admin/le_admin.php#L150\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/wp-letsencrypt-ssl/tags/7.8.6.6/admin/le_admin.php#L2120\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/wp-letsencrypt-ssl/tags/7.8.6.6/admin/le_admin.php#L2138\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3617401%40wp-letsencrypt-ssl\u0026new=3617401%40wp-letsencrypt-ssl\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee86d33-5a1e-4dc5-b2f6-0beffd8a6b2e?source=cve\",\"source\":\"security@wordfence.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-15786\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-23T13:37:41.149532Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-23T13:37:45.643Z\"}}], \"cna\": {\"title\": \"WP Encryption \u003c= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via \u0027imploded\u0027 Parameter\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Wordfence PRISM\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 4.4, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N\"}}], \"affected\": [{\"vendor\": \"gowebsmarty\", \"product\": \"WP Encryption \\u2013 Lifetime Free SSL Cert \u0026 HTTPS, Force SSL / HTTPS Redirect, SSL Security\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.8.6.6\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-07-22T07:16:48.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-07-22T20:35:43.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee86d33-5a1e-4dc5-b2f6-0beffd8a6b2e?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/wp-letsencrypt-ssl/tags/7.8.6.6/admin/le_admin.php#L2138\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/wp-letsencrypt-ssl/tags/7.8.6.6/admin/le_admin.php#L2120\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/wp-letsencrypt-ssl/tags/7.8.6.6/admin/le_admin.php#L150\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3617401%40wp-letsencrypt-ssl\u0026new=3617401%40wp-letsencrypt-ssl\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The WP Encryption \\u2013 One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect, Security \u0026 SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the \u0027imploded\u0027 parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Although file write content is passed through esc_html(), which encodes angle brackets and prevents direct PHP execution, plaintext configuration files such as .htaccess are fully writable and exploitable for denial-of-service or redirect attacks. This is only exploitable when the premium version of the software is enabled and active.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-07-24T22:39:47.800Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-15786\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-24T22:39:47.800Z\", \"dateReserved\": \"2026-07-14T19:18:05.209Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-07-23T09:33:57.567Z\", \"assignerShortName\": \"Wordfence\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…