4.9
Medium
CVE-2026-17602 The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in…
Description
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SSL Zen — SSL Certificate Installer & HTTPS Redirects 4.7 | earliest → 4.7.42 | No fix stated |
Other CVEs of SSL Zen — SSL Certificate Installer & HTTPS Redirects
The 4 CVEs of SSL Zen — SSL Certificate Installer & HTTPS Redirects →
CVE-2026-17577
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters…
6.1
Medium
CVE-2026-15463
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site…
6.1
Medium
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Medium