The vulnerability lies in the plugin trust model used by the openssl_encrypt tool. Earlier releases allow any unsigned plugin placed in the top‑level plugins/ directory or in unknown subdirectories to bypass signature verification. An attacker who can write to these directories can install a malicious unsigned plugin. Because the CLI process loads the plugin into the same process, the attacker gains full execution control and can access stored passwords and cryptographic keys. The weakness is classified as CWE‑347.

All releases of jahlives:openssl_encrypt before version 1.4.9 are affected. The product is commonly used in command‑line encryption workflows on servers and CI/CD pipelines; any deployment that runs an older binary is potentially vulnerable.

The CVSS score of 9.3 indicates critical severity, and the EPSS score is not available, meaning no published exploitation probability at this time. The vulnerability is not yet listed in the CISA KEV catalog. The likely attack path involves writing a malicious plugin file to the permitted directory and triggering its execution via the CLI. No network elevation is required beyond local write permissions to the plugin path.