CVE-2026-86781

Name of the Vulnerable Software and Affected Versions SSL Zen — SSL Certificate Installer & HTTPS Redirects versions prior to 4.7.40

Description An issue exists where the plugin fails to perform capability or nonce checks on a certificate-file download routine. This routine executes early in the WordPress admin request lifecycle, enabling any authenticated user, including those with Subscriber-level access, to download the site's TLS private key, certificates, and diagnostic logs. A nonce is a unique token used to prevent replay attacks by ensuring that a request is intentional and not forged.

Recommendations Update to version 4.7.40 or later.