CVE-2026-86781— SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure
Quick assessment
Affected
Unknown SSL Zen — SSL Certificate Installer & HTTPS Redirects
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SSL Zen — SSL 证书安装器与 HTTPS 重定向 WordPress 插件在 4.7.40 版本之前的版本中，未在证书文件下载例程中执行权限（capability）或 nonce 校验。该例程在 WordPress 后台请求生命周期的早期阶段执行，这使得任何已认证用户（包括订阅者）都能下载该站点的 TLS 私钥、证书以及诊断日志。
Possible ATT&CK Techniques 1 AI
T1578.002 · Create Cloud Instance
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86781
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | SSL Zen — SSL Certificate Installer & HTTPS Redirects | 0 ~ 4.7.40 | - |
|
II. Public POCs for CVE-2026-86781
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86781
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86781 (1)
-
🔗 SSL Zen < 4.7.40 – Subscriber+ TLS Private Key Disclosure | CVE 2026-86781 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-11 · 19 CVEs total
| CVE-2026-14562 | Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure | |
| CVE-2025-15695 | GTranslate < 3.0.10 - Admin+ Stored XSS | |
| CVE-2026-14559 | Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover | |
| CVE-2026-83545 | CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON | |
| CVE-2026-83546 | CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute | |
| CVE-2026-14566 | Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tamperi | |
| CVE-2026-14560 | Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload | |
| CVE-2026-14565 | Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configurat | |
| CVE-2026-14563 | Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover | |
| CVE-2026-86815 | BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing A | |
| CVE-2026-74925 | MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator | |
| CVE-2026-85677 | Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content | |
| CVE-2026-85678 | AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript | |
| CVE-2026-82305 | YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_ | |
| CVE-2026-86780 | Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text | |
| CVE-2026-86779 | Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart | |
| CVE-2026-86782 | Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR | |
| CVE-2026-86812 | WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-86815
BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Bac -
CVE-2026-86812
WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure an -
CVE-2026-86782
Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modifi -
CVE-2026-86779
Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion v -
CVE-2026-86780
Featured Image with URL < 1.0.6 - Contributor+ Stored XSS vi
V. Comments for CVE-2026-86781
No comments yet