CVE-2026-86781: SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SSL Zen — SSL Certificate Installer & HTTPS Redirectsto a version that resolves this vulnerability.Fixed in 4.7.40 - Compensating control
Restrict access to the WordPress admin area (e.g., block non-admin roles from using the affected plugin functionality) to prevent Subscribers from reaching the certificate-file download routine described.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user can exploit it, including users with the Subscriber role. No elevated WordPress capability is required.
What sensitive data can be obtained?
An attacker can download the site's TLS private key, certificates, and diagnostic logs through the certificate-file download routine.
Does exploitation require a CSRF token or nonce?
No. The affected routine does not perform nonce checks, and it also lacks capability checks.
How can I determine whether my site is affected?
Sites using the SSL Zen WordPress plugin before version 4.7.40 are affected. Review whether untrusted or low-privilege authenticated accounts, such as Subscribers, exist on the site.