CVE-2026-74884

The WordPress plugin openssl_encrypt (versions before 1.4.0) has a path traversal flaw in the _is_safe_path method. The unsanitized plugin_id parameter is used to build a plugin config directory path, allowing attackers to inject ../ sequences and read arbitrary directories outside the intended p...

CVE-2026-74884 openssl_encrypt before 1.4.0 Path Traversal via plugin_id

opensslencrypt versions before 1.4.0 contain a path traversal vulnerability in the issafepath method where the pluginid parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious pluginid containing path traversal sequences like '../' to...