CVE-2026-17602

Name of the Vulnerable Software and Affected Versions SSL Zen — SSL Certificate Installer & HTTPS Redirects versions prior to 4.7.43

Description The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder. Authenticated attackers with administrator-level access and above can exploit this by manipulating the file name parameter to read arbitrary files on the server, potentially exposing sensitive information.

Recommendations Update the plugin to version 4.7.43 or later. As a temporary mitigation, restrict access to the file name parameter for administrative users until the update is applied.