CVE-2026-86781
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Sep 11, 2026
Vendor
unknown
Description
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.