SSL Zen < 4.7.40 – Subscriber+ TLS Private Key Disclosure | CVE 2026-86781

Description

The plugin does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.

Proof of Concept

The PoC will be displayed on September 23, 2026, to give users the time to update.

Affects Plugins

ssl-zen

Fixed in 4.7.40

References

CVE

CVE-2026-86781

Classification

Type

AUTHBYPASS

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CWE-287

CVSS

5.3 (medium)

Miscellaneous

Original Researcher

Suhayb Ahmed (cyboltx)

Submitter

Suhayb Ahmed (cyboltx)

Verified

Yes

WPVDB ID

858977f8-8ea3-4d3d-8967-31567f6786ff

Timeline

Publicly Published

2026-09-09 (about 2 days ago)

Added

2026-09-09 (about 1 day ago)

Last Updated

2026-09-09 (about 1 day ago)

Other

Published

Title

Published

2024-10-14

Title

WP 2FA with Telegram < 3.1 - Two-Factor Authentication Bypass

Published

2026-07-03

Title

Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter

Published

2014-08-01

Title

All in One SEO Pack <= 2.1.5 - Unspecified Privilege Escalation

Published

2014-08-01

Title

WordPress <= 3.0.5 wp-admin/press-this.php Privilege Escalation

Published

2021-08-24

Title

Booster for WooCommerce < 5.4.4 - Authentication Bypass