{"id":"CVE-2026-104643","revision":"368bb4a0e5064cf39b7fa36f6ecd34b4","records":[{"revision":"368bb4a0e5064cf39b7fa36f6ecd34b4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104643","aliases":[],"title":"Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite","description":"The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.","state":0,"publishedAt":"2026-10-15T06:00:13.714+00:00","modifiedAt":"2026-10-15T11:01:27.57+00:00","affected":[{"ecosystem":"Vendor product","name":"Easy HTTPS Redirection (SSL)","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Easy HTTPS Redirection (SSL)\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.0.2\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/8b75ec7a-2b37-4e77-a83a-18b5e6f71d51/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104643","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104643","identifiers":["CVE-2026-104643"]},"retained":false,"historicalAffected":[]}],"coverage":[]}