CVE-2026-17602
Received Received - Intake

Directory Traversal in SSL Zen WordPress Plugin

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Wordfence

Description
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-17602
EUVD
EUVD-2026-86599

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ssl_zen ssl_certificate_installer to 4.7.42 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Directory Traversal issue in the SSL Zen plugin for WordPress. It affects versions up to 4.7.42 and is triggered by the 'file_name' parameter. Authenticated attackers with administrator access or higher can exploit this to read arbitrary files on the server, potentially exposing sensitive data.

Detection Guidance

Check for unauthorized file access attempts in server logs, particularly for requests containing the 'file_name' parameter. Look for patterns where the parameter tries to traverse directories, such as '../' sequences. Use tools like grep to search logs for suspicious activity.

Impact Analysis

If you use this plugin, an attacker could access sensitive files on your server, such as configuration files, logs, or other confidential data. This could lead to data breaches, unauthorized access, or further compromise of your WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face legal penalties, reputational damage, and loss of trust if such breaches occur due to non-compliance.

Mitigation Strategies

Immediately update the SSL Zen plugin to the latest version if an update is available. If no update exists, consider disabling or removing the plugin until a patch is released. Restrict administrator-level access to only necessary users and monitor server logs for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart