Plugins · wp-letsencrypt-ssl · data as of 2026-11-04
Is WP Encryption safe? Known vulnerabilities and latest version
- Latest version
- 7.8.8.2
- Last updated
- 2026-10-30
- Active installs
- 50,000+
- Known issues on record
- 3
- Unpatched in latest
- 0
- Tested up to WP
- 7.1.4 · PHP 7.0+
Lifetime SSL solution - Free SSL certificate & HTTPS redirect, force HTTPS, fix insecure site / SSL errors, security headers. — by WP Encryption
What to do
- Update to the latest version (7.8.8.2). Anything older than 7.8.8.2 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get wp-letsencrypt-ssl --field=version shows what you run; wp plugin update wp-letsencrypt-ssl updates it.
Check your version
Known vulnerabilities
3 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
medium 6.5 CVE-2026-108064 · published 2026-10-14
Missing authorization check in WP Encryption (older than 7.8.8.2)
- Affected
- older than 7.8.8.2
- Fixed in
- 7.8.8.2
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by CISA ADP
Details from the advisory
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.
medium 4.4 CVE-2026-15786 · published 2026-07-23
Path traversal / file read in WP Encryption (7.8.6.6 and older)
- Affected
- 7.8.6.6 and older
- Fixed in
- 7.8.7.1 *
- Access needed (per CVSS)
- Needs an admin-level account
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Although file write content is passed through esc_html(), which encodes angle brackets and prevents direct PHP execution, plaintext configuration files such as .htaccess are fully writable and exploitable for denial-of-service or redirect attacks. This is only exploitable when the premium version of the software is enabled and active.
NVD CVE-2026-15786Wordfence advisoryCode change (fix)Plugin source
high 7.5 CVE-2023-7046 · published 2024-04-09
Information disclosure in WP Encryption (7.0 and older)
- Affected
- 7.0 and older
- Fixed in
- 7.8.0 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0 via exposed Private key files. This makes it possible for unauthenticated attackers to extract sensitive data including TLS Certificate Private Keys
Recent activity
- 2026-10-30 — latest release on wordpress.org (7.8.8.2).
- 2026-10-14 — Missing authorization check disclosed (CVE-2026-108064), fixed in 7.8.8.2.
- 2026-07-23 — Path traversal / file read disclosed (CVE-2026-15786), fixed in 7.8.7.1.
- 2024-04-09 — Information disclosure disclosed (CVE-2023-7046), fixed in 7.8.0.
Get an email when WP Encryption has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for WP Encryption (wp-letsencrypt-ssl) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
Types found in this plugin: Missing authorization (1) · Path traversal and file read (1) · Sensitive data exposure (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/wp-letsencrypt-ssl (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/wp-letsencrypt-ssl"><img src="https://laskyr.com/plugins/wp-letsencrypt-ssl/badge.svg" alt="WP Encryption vulnerability status"></a>