Description

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T07:16:47.547Z",
  "pubdate": "2026-09-11T07:16:47.547Z",
  "executiveSummary": "The SSL Zen – SSL Certificate Installer & HTTPS Redirects plugin is vulnerable to an unauthorized sensitive information disclosure flaw.\nThis vulnerability stems from a lack of capability checks and nonce validation within the plugin's certificate-file download routine, which executes during the early stages of the WordPress admin request lifecycle.\nThe flaw allows any authenticated user, regardless of their privilege level—including those with the 'Subscriber' role—to programmatically download sensitive cryptographic assets.\nImpacted information includes the site's TLS private key, digital certificates, and internal diagnostic logs.\nSuccessful exploitation facilitates unauthorized access to private encryption materials, enabling potential man-in-the-middle (MitM) attacks, decryption of captured traffic, and full compromise of the site's transport layer security integrity.\nThe vulnerability affects all versions of the SSL Zen plugin prior to 4.7.40.\nThe risk is critical, as it bypasses standard access control mechanisms, granting low-privileged accounts sensitive server-side configuration data.",
  "technicalDetails": "The vulnerability originates in the SSL Zen plugin's certificate-file download routine. The root cause is an improper authorization check, wherein the plugin fails to verify user permissions (capabilities) or validate anti-CSRF nonces before initiating a file download process.\nBecause the function is hooked into the WordPress admin request lifecycle, it is processed before robust security checks are enforced, effectively bypassing the access control layers intended to restrict administrative actions to privileged users.\nThe attack flow follows a predictable pattern: 1) The attacker authenticates as a low-privileged user (e.g., Subscriber). 2) The attacker crafts a targeted HTTP request directed toward the vulnerable download routine within the plugin's code. 3) Since the routine lacks strict conditional checks for `current_user_can('manage_options')` or equivalent authorization primitives, the application process proceeds to retrieve the requested sensitive files from the server's filesystem.\nThe target files include, but are not limited to, the TLS private key (`.key`), public certificate (`.crt`), and diagnostic logs, which may contain additional sensitive environment data.\nThe lack of a cryptographic nonce means the request is susceptible to CSRF-based exploitation, where an attacker could potentially force an administrator's browser to execute the download while authenticated, if not already exploited directly by an attacker-controlled account.\nOnce the private key is obtained, the post-exploitation impact is severe. An attacker can use the key to impersonate the legitimate web server, intercept encrypted traffic, or decrypt archived sessions previously captured via network monitoring.\nThe plugin versions prior to 4.7.40 remain exposed to this oversight. Because the vulnerability resides in a core plugin function designed to handle administrative certificate management, it remains reachable via any standard WordPress administrative entry point once the user has obtained a valid session cookie.\nThe issue is exacerbated by the nature of the information leaked; while administrative panels often contain sensitive data, the exposure of private keys fundamentally compromises the site's SSL/TLS security architecture, rendering the transition to HTTPS moot until certificates are revoked and keys are regenerated."
}