The vulnerability is caused by a missing capability check on the function that manages SSL requests. As a result, any authenticated user with a subscriber role or higher can trigger the plugin to reset its SSL setup state, mark SSL as complete without full validation, and alter plan selection options. This can lead to an attacker changing the site’s HTTPS enforcement behaviour or bypassing security settings, potentially allowing domain hijacking or downgrade attacks. The weakness aligns with the vulnerability class of missing authorization for privileged operations.

The issue affects the WordPress plugin "WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan" provided by gowebsmarty. All releases up to and including version 7.8.5.10 are impacted. Once installed on a WordPress site, any subscriber or higher role can manipulate SSL configuration through the plugin’s admin interface or AJAX endpoints.

With a CVSS score of 5.4, the vulnerability is considered moderate in severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation at this time. The attack vector is likely local to the WordPress installation: an authenticated user must already have logged in with a subscriber or higher role. Once authenticated, the attacker can issue requests that trigger the unauthorised SSL‑setup logic. Because the flaw does not require elevated privileges beyond a normal subscriber account, many sites are potentially at risk, particularly those with large numbers of users at or above this role.