CVE-2026-3829 is a missing authorization vulnerability (CWE-862) in the WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan WordPress plugin. The flaw exists in the 'wple_basic_get_requests' function, which lacks proper capability checks, allowing authenticated users with low privileges (subscriber and above) to manipulate SSL configuration states and plan selections. This could lead to unauthorized modification of plugin data and potentially disrupt SSL enforcement or configuration integrity.

An attacker with subscriber-level access can reset the SSL setup state, causing SSL to appear as properly configured even if it is not, and can alter plan selection options within the plugin. This may undermine the security assurances provided by the plugin, potentially leading to misconfigurations that affect site security. There is no indication of direct confidentiality impact, but integrity and availability of SSL configuration are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for suspicious changes to SSL settings. Avoid granting unnecessary privileges to low-level authenticated users.