Description

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Although file write content is passed through esc_html(), which encodes angle brackets and prevents direct PHP execution, plaintext configuration files such as .htaccess are fully writable and exploitable for denial-of-service or redirect attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-07-23T10:16:51.207Z",
  "pubdate": "2026-07-23T10:16:51.207Z",
  "executiveSummary": "The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress in all versions up to, and including, 7.8.6.6 is vulnerable to a severe Directory Traversal vulnerability. The security flaw is triggered via the 'imploded' parameter, allowing authenticated actors with administrative privileges to read the contents of arbitrary files stored on the underlying server. These files may contain sensitive system and application information.\nFurthermore, the vulnerability allows for file write operations. Although the content passed during write operations is processed through esc_html()—which encodes angle brackets and prevents direct arbitrary PHP code execution—plaintext configuration files such as .htaccess remain fully writable and exploitable. This introduces significant risk implications, enabling adversaries to mount denial-of-service (DoS) conditions or execute unauthorized redirect attacks.\nThe exploitation of this vulnerability requires high-privileged access, specifically administrator-level access and above, which limits external unauthenticated attacks but significantly impacts internal threat models or compromised administrative accounts. The risk profile encompasses complete exposure of sensitive server-side files and manipulation of critical routing configurations.",
  "technicalDetails": "The vulnerability stems from improper input validation and insufficient path sanitization within the WP Encryption plugin. Specifically, the component handling the 'imploded' parameter fails to adequately restrict directory traversal sequences, such as dot-dot-slash (../) patterns, allowing callers to break out of the intended application directory.\nThe vulnerable component is exposed to authenticated users holding administrator-level access and above. Because the administrative interface processes requests containing the 'imploded' parameter without rigorous normalization and validation of the target file paths, the application reads and returns the contents of arbitrary files from the server filesystem.\nThe attack flow proceeds as follows: 1) An authenticated attacker with administrative privileges crafts an HTTP request targeting the vulnerable plugin endpoint. 2) The attacker supplies a crafted value containing directory traversal sequences within the 'imploded' parameter. 3) The application processes the parameter, resolving the traversal path to access arbitrary system files outside the web root or intended restricted directories. 4) The server reads the target file and exposes its contents back to the attacker, or alternatively processes a file write operation.\nDuring file write operations, the input data is sanitized using esc_html(), which encodes angle brackets (such as < and >) to mitigate direct cross-site scripting and prevent direct PHP execution. However, this sanitization mechanism is insufficient for plaintext configuration files like .htaccess. Consequently, attackers can overwrite or modify .htaccess content directly, enabling them to introduce malicious rewrite rules that lead to denial-of-service conditions or malicious traffic redirection.\nThe affected versions include all releases of the WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin up to, and including, version 7.8.6.6. Exploitation requires network access to the WordPress administrative dashboard and valid administrative credentials."
}