Executive brief
SSL Zen is a WordPress plugin that manages SSL/TLS certificates and automates HTTPS redirection for WordPress sites. A flaw in the plugin allows any authenticated WordPress user—including low-privilege "Subscriber" accounts—to download the site's private encryption keys, certificates, and diagnostic logs by bypassing permission checks. An attacker with a free account on a site with open registration could extract these sensitive files and use them to impersonate the website, intercept traffic, or access sensitive data.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the SSL Zen plugin's certificate file download routine. The download handler runs on the WordPress admin_init hook, which fires before the plugin's own capability checks, allowing any authenticated user to bypass the menu-page authorization gate. The vulnerability affects versions before 4.7.40; an attacker with an authenticated session (even a Subscriber-level account) can send a GET request to wp-admin/index.php with parameters such as ?page=ssl_zen&tab=step3&download=private to retrieve the site's PEM-encoded private key, certificate, CA bundle, or diagnostic logs. No nonce validation is performed. The fix is to upgrade to version 4.7.40 or later, which adds proper capability and nonce checks before serving certificate files.
Affected products
- SSL Zen SSL Zen — SSL Certificate Installer & HTTPS Redirects before 4.7.40
Timeline
- 2026-09-09: disclosed
- 2026-09-11: patched: Version 4.7.40 released