CVE-2026-15786

Name of the Vulnerable Software and Affected Versions WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan versions prior to 7.8.6.7

Description A Directory Traversal issue exists when the premium version of the software is enabled and active. Authenticated attackers with administrator-level access or higher can read arbitrary files on the server through the imploded parameter, potentially exposing sensitive information. While the use of esc html() prevents direct PHP execution by encoding angle brackets, plaintext configuration files like .htaccess remain writable, allowing for redirect attacks or denial-of-service. Directory Traversal is a flaw that allows an attacker to access files and directories stored outside the web root folder.

Recommendations Update the plugin to version 7.8.6.7 or later. Restrict access to the imploded parameter to minimize the risk of exploitation.