Description

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-25T08:16:40.247Z",
  "pubdate": "2026-09-25T08:16:40.247Z",
  "executiveSummary": "The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is susceptible to a directory traversal vulnerability in all versions up to and including 4.7.42.\nThe vulnerability originates from the improper sanitization of the 'file_name' parameter, which permits an authenticated attacker with administrative privileges to traverse the filesystem and access arbitrary files.\nSuccessful exploitation allows for the unauthorized retrieval of sensitive server-side data, potentially including configuration files, credentials, or other critical system artifacts.\nThe threat is limited to authenticated users possessing administrator-level access, meaning an attacker must already have compromised a high-level administrative account or be an existing administrator to initiate the exploit.\nThe risk implication is significant as it grants read access to the underlying server environment, which can be leveraged to facilitate further system compromise, privilege escalation, or lateral movement within the hosting infrastructure.",
  "technicalDetails": "The vulnerability is classified as a Path Traversal (CWE-22) flaw occurring within the SSL Zen plugin's file handling logic. The root cause is the failure of the application to adequately validate or sanitize the 'file_name' input parameter before utilizing it in filesystem operations.\nBy manipulating the 'file_name' parameter, an attacker can supply sequences such as '../' to escape the intended directory scope. This allows the application process to access files located outside of the plugin’s designated file storage directories, traversing the server’s file system root.\nThe exploitation flow begins with the attacker interacting with the vulnerable plugin function that processes the 'file_name' parameter. By injecting dot-dot-slash (../) sequences, the attacker traverses the directory hierarchy to reference sensitive system files, such as wp-config.php or system-level configuration files.\nBecause the plugin processes these requests on behalf of an authenticated administrator, the application executes the file read operation with the privileges of the web server user. The server subsequently returns the contents of the requested file to the attacker’s browser or HTTP client.\nThe vulnerability is restricted to environments where the attacker has already obtained administrative access to the WordPress dashboard. While this necessitates a high level of existing access, it represents a critical failure in the principle of least privilege, as administrative dashboard access should not inherently grant the ability to read arbitrary files from the filesystem.\nThe impact of a successful exploitation is severe; the attacker can gain deep visibility into the server’s security configuration. Access to database credentials within configuration files could lead to full database compromise, while access to SSH keys or environment variables could allow the attacker to pivot from the WordPress installation to the underlying operating system. The vulnerability remains present in all versions up to 4.7.42, necessitating immediate attention to ensure that any file-based input parameters are subjected to strict whitelist-based validation or absolute path resolution to prevent directory escapes."
}