CVE-2026-17602: Sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects

Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days.

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected products

• Sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects: up to and including 4.7.42

Published 2026-09-25. Last modified 2026-09-25.