CVE-2026-15786 is a CWE-22 path traversal vulnerability in the WP Encryption WordPress plugin (versions up to and including 7.8.6.6). It allows authenticated administrators to read arbitrary server files via the 'imploded' parameter. While file content writes are sanitized to prevent PHP execution, configuration files such as .htaccess remain writable, which can be abused for denial-of-service or redirect attacks. Exploitation requires the premium version of the plugin to be enabled. No official patch or remediation level has been published as of the data provided.

The vulnerability allows disclosure of sensitive server files to authenticated administrators, potentially exposing confidential information. Writable configuration files can be altered to disrupt service or redirect traffic, causing denial-of-service or malicious redirection. There is no indication of remote unauthenticated exploitation or direct code execution. The impact is limited to users with high privileges and the premium plugin version.

No official patch or remediation has been published yet. Since exploitation requires administrator privileges and the premium version enabled, restrict access to trusted administrators only and consider disabling the premium features until a fix is available. Monitor vendor advisories for updates and apply official patches once released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.