CVE-2026-104643
Deferred Deferred - Pending Action

Easy HTTPS Redirection URL Rewrite and Data Exposure

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: WPScan

Description
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-104643
EUVD
EUVD-2026-101850

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Easy HTTPS Redirection (SSL) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Easy HTTPS Redirection WordPress plugin before version 2.0.2 has a vulnerability where some AJAX actions lack capability checks. This allows any authenticated user, including low-privilege users like Subscribers, to read scan results containing URLs from private or draft posts and site options. They can also trigger a site-wide rewrite of these URLs after an administrator runs a scan.

Detection Guidance

Check the installed version of the Easy HTTPS Redirection plugin. If it is below 2.0.2, the system is vulnerable. Use WordPress admin dashboard or run a command like 'wp plugin list' in the WordPress directory to verify the plugin version.

Impact Analysis

An attacker with basic access could view sensitive URLs from private content, expose draft post links, or modify site-wide URLs, potentially redirecting users to malicious sites. This could lead to data leaks, phishing attacks, or site defacement if exploited.

Compliance Impact

This vulnerability could violate GDPR by exposing private post URLs or draft content, leading to unauthorized access to personal data. For HIPAA, if the site handles health information, leaked URLs might expose protected data. Non-compliance risks fines or legal penalties.

Mitigation Strategies

Update the Easy HTTPS Redirection plugin to version 2.0.2 or later immediately. Remove or disable the plugin if an update is not available. Review site options and post URLs for unauthorized changes after updating.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104643. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart