🔐 CVE Alert

CVE-2026-17602

MEDIUM 4.9

SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter

CVSS Score
4.9
EPSS Score
0.0%
EPSS Percentile
0th

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CWE CWE-22
Vendor sslzen
Product ssl zen — ssl certificate installer & https redirects
Published Sep 25, 2026
Stay Ahead of the Next One

Get instant alerts for sslzen ssl zen — ssl certificate installer & https redirects

Be the first to know when new medium vulnerabilities affecting sslzen ssl zen — ssl certificate installer & https redirects are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

sslzen / SSL Zen — SSL Certificate Installer & HTTPS Redirects
0 ≤ 4.7.42

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf4cc39-3a26-462d-a540-2d53e53dfa66?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.42/ssl_zen/classes/class.ssl_zen_admin.php#L496 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.42/ssl_zen/classes/class.ssl_zen_admin.php#L492 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.42/ssl_zen/classes/class.ssl_zen_admin.php#L54 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.12/ssl_zen/classes/class.ssl_zen_admin.php#L496 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.12/ssl_zen/classes/class.ssl_zen_admin.php#L492 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.12/ssl_zen/classes/class.ssl_zen_admin.php#L54 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?reponame=&old=3701590%40ssl-zen&new=3701590%40ssl-zen

Credits

Wordfence PRISM