openssl_encrypt versions prior to 1.4.9 contain a critical signature verification vulnerability in the gpg_runner.verify_detached function. The flaw arises from only checking the VALIDSIG status while ignoring REVKEYSIG, EXPKEYSIG statuses and GPG exit codes. This oversight allows attackers who possess revoked or expired signing keys to bypass signature verification entirely. Successful exploitation enables the execution of malicious plugins within the host process. The vulnerability poses a significant risk as it undermines the integrity of the plugin loading mechanism. Users are advised to upgrade to version 1.4.9 or later to remediate the issue.