What is CVE-2026-86781?

CVE-2026-86781 is a medium-severity vulnerability in SSL Zen — Certificate Installer & HTTPS Redirects, classified under Improper Authentication. CVSS score: 5.3/10. Published 2026-09-11.

How severe is CVE-2026-86781?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in SSL Zen — Certificate Installer & HTTPS Redirects

CVE-2026-86781

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.

Vulnerability class: Broken Authentication

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Unknown Ssl Zen — Certificate Installer & Https Redirects

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-86781?: CVE-2026-86781 is a medium-severity vulnerability in SSL Zen — Certificate Installer & HTTPS Redirects, classified under Improper Authentication. CVSS score: 5.3/10. Published 2026-09-11.
How severe is CVE-2026-86781?: Medium severity. CVSS v3 base score is 5.3 out of 10.