CVE-2026-3829 Overview
CVE-2026-3829 affects the WP Encryption WordPress plugin, which provides one-click free SSL certificate installation and HTTPS redirect functionality. The vulnerability stems from missing capability checks on the wple_basic_get_requests function in all versions up to and including 7.8.5.10. Authenticated attackers with subscriber-level access or above can reset the SSL setup state, force SSL to appear complete, and modify plan selection options. The flaw is classified under [CWE-862: Missing Authorization]. Site administrators relying on this plugin for SSL/HTTPS management face configuration tampering risks from any authenticated low-privilege user.
Critical Impact
Authenticated subscriber-level users can manipulate SSL setup state and plan selection settings, undermining administrative control over the plugin's certificate workflow.
Affected Products
- WP Encryption – One Click Free SSL Certificate plugin for WordPress
- WP Encryption SSL / HTTPS Redirect, Security & SSL Scan plugin
- All versions up to and including 7.8.5.10
Discovery Timeline
- 2026-05-14 - CVE-2026-3829 published to NVD
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-3829
Vulnerability Analysis
The vulnerability resides in the wple_basic_get_requests AJAX handler within the WP Encryption plugin. The function processes plugin state requests but omits the capability checks required to restrict access to administrators. Any authenticated user, including subscribers, can invoke the handler and trigger administrative actions. Successful exploitation allows attackers to reset the SSL setup state, force the plugin UI to report SSL as fully configured, and alter the selected plan options.
This affects integrity by enabling unauthorized data modification and availability by interrupting legitimate SSL workflows. Confidentiality is not directly impacted, since the function does not expose sensitive data. The vendor addressed the issue in version 7.8.5.11 by adding the missing authorization controls, as visible in the patch comparing files admin/le_admin.php and admin/le_handlers.php between tags 7.8.5.10 and 7.8.5.11.
Root Cause
The root cause is the absence of WordPress capability checks such as current_user_can() and proper nonce verification in the wple_basic_get_requests function. The handler is registered to AJAX endpoints accessible to any authenticated user, but the function executes privileged state changes without verifying the caller's role. This pattern is a textbook [CWE-862] Missing Authorization defect.
Attack Vector
Exploitation requires only an authenticated session at subscriber level or higher. WordPress sites that permit open user registration are most exposed, since any visitor can create a subscriber account. The attacker sends crafted requests to the plugin's AJAX endpoint to reach wple_basic_get_requests. The handler executes the requested state changes without enforcing authorization, modifying SSL configuration flags and plan selection values stored by the plugin.
No verified public exploit code is available. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the underlying code changes.
Detection Methods for CVE-2026-3829
Indicators of Compromise
- Unexpected POST or GET requests from low-privilege user sessions targeting admin-ajax.php with the wple_basic_get_requests action parameter.
- Sudden changes to WP Encryption plugin options in the wp_options table, particularly SSL setup completion flags and plan selection values.
- Web access logs showing repeated invocations of the plugin's AJAX action from accounts that have never accessed /wp-admin/ administrative pages.
Detection Strategies
- Audit WordPress role and capability data to identify subscriber accounts performing plugin administrative actions.
- Review HTTP request logs for action=wple_basic_get_requests parameters originating from non-administrator user IDs.
- Compare plugin configuration entries in the database against known-good baselines to detect unauthorized state resets.
Monitoring Recommendations
- Enable WordPress activity logging plugins that record AJAX action invocations along with the authenticated user role.
- Forward WordPress and web server logs to a centralized SIEM and alert on AJAX actions tied to vulnerable plugins.
- Monitor for spikes in new low-privilege account registrations followed by AJAX traffic to plugin endpoints.
How to Mitigate CVE-2026-3829
Immediate Actions Required
- Update the WP Encryption plugin to version 7.8.5.11 or later on all WordPress installations.
- Audit existing subscriber and contributor accounts and remove any that are unrecognized or unused.
- Review WP Encryption plugin settings and restore the correct SSL setup state and plan selection after patching.
Patch Information
The vendor fixed the vulnerability in WP Encryption version 7.8.5.11 by adding capability checks to the affected handlers. Review the upstream changes in the le_admin.php changeset and the le_handlers.php changeset.
Workarounds
- Disable open user registration in WordPress settings to reduce the pool of accounts that can reach the vulnerable function.
- Temporarily deactivate the WP Encryption plugin until the upgrade to 7.8.5.11 is completed.
- Use a web application firewall rule to block requests where the AJAX action is wple_basic_get_requests and the session role is below administrator.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
