CVE-2026-86781
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
Risk Assessment
Even a user with the lowest privileges can download the site's TLS private key, enabling server impersonation and decryption of HTTPS traffic.
Recommendation
Update the SSL Zen plugin to version 4.7.40 or later and, if a leak is suspected, replace the TLS key and certificates.
Other vulnerabilities in SSL Zen
See all- CVE-2026-17602Medium
The SSL Zen plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.7.42 via the 'file_name' parameter. This allows reading the contents of arbitrary files on the server.
- CVE-2026-17577Medium
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to and including 4.7.42. The getMessages() function decodes base64 input and echoes raw HTML without escaping.
- CVE-2026-28569High
Unauthenticated Cross Site Scripting (XSS) in SSL Zen versions up to 4.7.43.
Original NVD description (English source)
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.