Easy HTTPS Redirection CVE-2026-104643

Requires (1) an authenticated session at minimum Subscriber level - so sites that disable open registration greatly reduce exposure - and (2) that an administrator has previously run the Easy HTTPS Redirection (SSL) plugin's content scanner, since the collected URLs from private/draft posts and site options must exist before they can be read or rewritten. The vulnerable code paths are specific plugin AJAX actions that omit capability checks. No user interaction from a victim is needed (UI:N), but the dependency on a prior administrator-triggered scan is why complexity is high (AC:H) and why opportunistic mass exploitation is unlikely. Fixed in version 2.0.2.

This is a genuine but modest-priority issue, not a high-severity emergency. The CVSS 3.1 base score of 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) is consistent with the description: remotely reachable but gated behind authentication (PR:L) and a meaningful precondition (AC:H). The flaw is CWE-862 Missing Authorization - some AJAX actions skip capability checks, so a low-privilege Subscriber can read scanner-collected URLs and trigger a site-wide URL rewrite. POC/exploit code is publicly available (WPScan), which raises practical exploitability, but the CVE is NOT on CISA KEV and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct signals. No SSVC decision data was supplied. Two conditions sharply limit real-world risk: the attacker needs a valid authenticated account (at least Subscriber), and an administrator must already have run the plugin's content scanner before the data exists to read or rewrite. On sites that disallow open registration, the authenticated-user prerequisite alone significantly narrows the attack surface. Net: real and worth patching, but low urgency relative to unauthenticated RCE-class issues.

On a WordPress site that permits user registration, an attacker registers a Subscriber-level account and calls the plugin's unprotected AJAX actions. Because capability checks are missing, they retrieve URLs the content scanner harvested from private and draft posts plus site options, and can invoke the site-wide URL rewrite. Public exploit code for this flaw is available via WPScan, lowering the barrier to abuse, though exploitation only works after an administrator has run a scan.