Vulnerability · Published Oct 15, 2026 · Assigned by WPScan

CVE-2026-104643Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite

Medium 4.2

In plain English

A medium-severity missing authorization in Easy HTTPS Redirection (SSL) from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.1%top 96.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Easy HTTPS Redirection (SSL)	0 – before 2.0.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/8b75ec7a-2b37-4e77-a83a-18b5e6f71d51/ exploit, vdb-entry, technical-description