Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86781

SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86781

Published

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86781

Published

SSL Zen — SSL Certificate Installer & HTTPS Redirects

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "SSL Zen — SSL Certificate Installer & HTTPS Redirects",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "0",
                            "lessThan": "4.7.40"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON