CVE WatchJul 23, 2026

CVE-2026-15786

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directo

CVSS

4.9

Medium

EPSS

—

KEV

—

Exploit Today

0-100

Published: Jul 23, 2026 · Last modified: Jul 23, 2026 · CWE-22

EPSS · 30d

Not enough EPSS history yet.

Technical description

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Although file write content is passed through esc_html(), which encodes angle brackets and prevents direct PHP execution, plaintext configuration files such as .htaccess are fully writable and exploitable for denial-of-service or redirect attacks.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-656076.5 MED

—

——0SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.5h CVE-2026-5955510.0 CRI

—

——0Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.5h CVE-2026-595427.7 HIG

—

——0Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.5h CVE-2026-577165.3 MED

—

——0Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.5h CVE-2026-576967.1 HIG

—

——0Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.5h CVE-2026-65754—

10.5%

——3ReReplacer XML include paths could read files outside the site directory.7h