Ssl Zen Ssl Certificate Installer Https Redirects
Monthly
TLS private key disclosure in the SSL Zen WordPress plugin (all versions before 4.7.40) allows any authenticated user - including Subscribers, the lowest-privilege WordPress role - to download the site's TLS private key, certificate files, and diagnostic logs. The plugin's certificate-file download handler fires early in the WordPress admin request lifecycle without performing WordPress capability checks or nonce verification, bypassing the standard authorization layer entirely. A public exploit is available via WPScan; vendor-released patch 4.7.40 resolves the issue.
TLS private key disclosure in the SSL Zen WordPress plugin (all versions before 4.7.40) allows any authenticated user - including Subscribers, the lowest-privilege WordPress role - to download the site's TLS private key, certificate files, and diagnostic logs. The plugin's certificate-file download handler fires early in the WordPress admin request lifecycle without performing WordPress capability checks or nonce verification, bypassing the standard authorization layer entirely. A public exploit is available via WPScan; vendor-released patch 4.7.40 resolves the issue.