CVE-2026-86781 - Vulnerability Details - OpenCVE

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/858977f8-8ea3-4d3d-8967-31567f6786ff/

History

Fri, 11 Sep 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-284

Fri, 11 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-287
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 11 Sep 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284

Fri, 11 Sep 2026 06:30:00 +0000

Type	Values Removed	Values Added
Description		The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
Title		SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure
References		https://wpscan.com/vulnerability/858977f8-8ea3-4d3d-8967-31567f6786ff/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-09-11T06:00:09.019Z

Updated: 2026-09-11T10:00:47.722Z

Reserved: 2026-09-08T11:44:29.809Z

Link: CVE-2026-86781

Vulnrichment

Updated: 2026-09-11T09:58:56.365Z

NVD

Status : Deferred

Published: 2026-09-11T07:16:47.547

Modified: 2026-09-11T17:35:21.440

Link: CVE-2026-86781

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86781", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-09-08T11:44:29.809Z", "datePublished": "2026-09-11T06:00:09.019Z", "dateUpdated": "2026-09-11T10:00:47.722Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-11T06:00:09.019Z"}, "title": "SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure", "problemTypes": [{"descriptions": [{"description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "4.7.40"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs."}], "references": [{"url": "https://wpscan.com/vulnerability/858977f8-8ea3-4d3d-8967-31567f6786ff/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Suhayb Ahmed (cyboltx)", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-11T09:59:28.245553Z", "id": "CVE-2026-86781", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-11T10:00:47.722Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86781", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-09-08T11:44:29.809Z", "datePublished": "2026-09-11T06:00:09.019Z", "dateUpdated": "2026-09-11T10:00:47.722Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-11T06:00:09.019Z"}, "title": "SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure", "problemTypes": [{"descriptions": [{"description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "4.7.40"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs."}], "references": [{"url": "https://wpscan.com/vulnerability/858977f8-8ea3-4d3d-8967-31567f6786ff/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Suhayb Ahmed (cyboltx)", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-86781", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-11T09:59:28.245553Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-11T09:58:56.365Z"}}]}}