WordPress WP Encryption plugin < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement vulnerability

Unauthenticated Certificate Private Key and ACME Order Replacement vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content versions 7.8.8.2...

CVE-2026-108064

The WP Encryption WordPress plugin versions before 7.8.8.2 contains a vulnerability in its SSL certificate-provisioning routine. Due to a lack of capability or nonce checks on the wple_auto_handler , unauthenticated users can overwrite the site's certificate private key and replace pending Let's ...