Easy Https Redirection Ssl
Monthly
Missing capability checks in the Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 allow any authenticated user - a Subscriber is sufficient per the CVSS vector (PR:L, authenticated) - to invoke plugin AJAX actions that read the URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs. Exploitation is conditional rather than opportunistic: the attacker needs a low-privileged account on the site, and an administrator must have already run the plugin's content scanner so that the harvested URL set exists, which is what drives the High attack complexity (AC:H) in the CVSS 4.2 score. Publicly available exploit code exists and the issue is fixed in version 2.0.2, but it is not listed in CISA KEV, and the exposure is meaningfully reduced on sites that disable open registration. This is a genuine but modest-priority issue, not a high-severity emergency.
Missing capability checks in the Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 allow any authenticated user - a Subscriber is sufficient per the CVSS vector (PR:L, authenticated) - to invoke plugin AJAX actions that read the URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs. Exploitation is conditional rather than opportunistic: the attacker needs a low-privileged account on the site, and an administrator must have already run the plugin's content scanner so that the harvested URL set exists, which is what drives the High attack complexity (AC:H) in the CVSS 4.2 score. Publicly available exploit code exists and the issue is fixed in version 2.0.2, but it is not listed in CISA KEV, and the exposure is meaningfully reduced on sites that disable open registration. This is a genuine but modest-priority issue, not a high-severity emergency.