The WP Encryption plugin lacks a capability or nonce check in its certificate‑provisioning handler, allowing an impersonated request to replace the site's private key and the pending Let's Encrypt order in a single transaction. Attackers can repeat this operation to continually regenerate challenge material, preventing the administrator from completing the certificate issuance process. The primary consequence is a denial of service against the site’s HTTPS functionality, as the site will fail to obtain a valid certificate. While the exploit does not expose the original private key, it forces disruption of secure communications, impacting confidentiality and availability for visitors.

Any WordPress site running an instance of the WP Encryption plugin with a version older than 7.8.8.2 is affected. The vulnerability applies regardless of other security measures, as the missing authorization check is performed solely by the plugin.

The CVSS score of 6.5 reflects a moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not included in CISA’s KEV catalog. An attacker can exploit the flaw simply by sending an unauthenticated HTTP request to the wple_auto_handler endpoint; no additional compromise or privileged credentials are required. The impact is limited to denial of service for certificate provisioning, but the exploit is straightforward and could be automated if discovered. Overall, the risk is moderate, with a low likelihood of widespread exploitation in the near term.