SSL Zen EUVD-2026-86599

Requires an authenticated session with WordPress administrator-level capabilities (or higher) on a site running SSL Zen <= 4.7.42; the attacker must reach the admin handler in class.ssl_zen_admin.php and control the 'file_name' parameter. What limits exploitation: the PR:H barrier is significant because WordPress administrators already possess broad file access via the plugin/theme editor and upload capabilities, so the vulnerability meaningfully adds risk only on multi-admin, multisite, or delegated-admin deployments, or after an admin account is already compromised. No end-user interaction is needed (UI:N), and no special non-default plugin configuration is described beyond having the plugin installed and active.

This is a genuinely low-priority issue despite a CWE-22 arbitrary-file-read primitive, and the raw CVSS of 4.9 (Medium) reflects that correctly. The most important signal is PR:H in the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N): exploitation requires administrator-level WordPress access. In the WordPress trust model an administrator can already read and write server files through the built-in plugin/theme editor, upload arbitrary PHP, and typically escalate to code execution - so a traversal-based file-read gained by an existing admin adds little real-world privilege beyond what that role already grants. The realistic threat is narrow: a lower-trust admin on a multi-admin or multisite install reading files outside the intended web scope, or an attacker who has already compromised an admin account. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis'. There is no conflict between the signals - network vector with AC:L is offset entirely by the PR:H barrier and C-only impact (I:N/A:N). Treat as routine patch hygiene, not an emergency.

An authenticated user holding administrator (or higher) access to a WordPress site running SSL Zen <= 4.7.42 sends a crafted request supplying a traversal payload (e.g. ../../wp-config.php) in the 'file_name' parameter handled by class.ssl_zen_admin.php, causing the plugin to return the contents of an arbitrary server file such as wp-config.php or /etc/passwd. This is most meaningful on shared or multi-admin installations where a semi-trusted admin reads files beyond their intended scope. No public proof-of-concept is referenced in the available data.