EUVD-2026-75970
GHSA-jmvf-92jg-53j3
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
AC:H in source is overstated; any Subscriber can hit the endpoint with no special conditions, so AC:L; C:H justified by TLS private key exposure.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The SSL Zen - SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
AnalysisAI
TLS private key disclosure in the SSL Zen WordPress plugin (all versions before 4.7.40) allows any authenticated user - including Subscribers, the lowest-privilege WordPress role - to download the site's TLS private key, certificate files, and diagnostic logs. The plugin's certificate-file download handler fires early in the WordPress admin request lifecycle without performing WordPress capability checks or nonce verification, bypassing the standard authorization layer entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account at Subscriber level or above - no administrator or editor privilege is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS score of 5.3 uses AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the SSL Zen plugin to version 4.7.40 or later, which introduces the required WordPress capability and nonce checks on the download handler; this is confirmed by the WPScan advisory (https://wpscan.com/vulnerability/858977f8-8ea3-4d3d-8967-31567f6786ff/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allShare
External POC / Exploit Code
Leaving vuln.today