CVE-2026-86781

SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.

Affected

SSL Zen — SSL Certificate Installer & HTTPS Redirects

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.18% chance of exploitation in the next 30 days, 7th percentile

Published

2026-09-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/858977f8-8ea3-4d3d-8967-31567f6786ff/

References

• CVE Record
• NVD entry