CVE-2026-86781Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/858977f8-8ea3-4d3d-8967-31567f6786ff/

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 3 classified signals
Peaked at 2 mentions on most recent observed day (2026-09-27)
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-14	1	Disclosure1
2026-09-27	2	Disclosure2

Full discourse3 posts

Ciberseguridad LATAM@CibersegLATAM46d
Disclosure
🚨 Falla en plugin de WordPress expone claves TLS a usuarios sin privilegios CVE-2026-86781 permite a cualquier cuenta autenticada — incluso suscriptores sin permisos — descargar la clave privada del certificado SSL del sitio. ¿Su empresa ya evaluó esto? https://ciberseguridadlatam.com/falla-en-plugin-de-wordpress-expone-claves-tls-a-usuarios-sin-privilegios/?utm_source=x&utm_medium=social&utm_campaign=falla-en-plugin-de-wordpress&utm_content=post https://t.co/74ns7uyezP
Post summary
The text announces a vulnerability in a WordPress plugin (CVE-2026-86781) that allows authenticated users to download private SSL keys, prompting companies to evaluate the risk.
03081971
22.7K followersView on X
Suhayb🎖@cyboltx33d
Disclosure
Two new CVE disclosures published! 🚀💥 • CVE-2026-86781 | SSL Zen: Allowed Subscriber+ users to expose sensitive TLS private keys. • CVE-2026-81429 | Export & Import WPBakery: Lack of CSRF protection leading to Stored XSS execution. #Infosec #CVE #AppSec #BugBounty
Post summary
The text announces two new CVE disclosures with brief technical descriptions, but lacks any mention of PoC, exploit code, active exploitation, or patches.
1000058
28 followersView on X
Suhayb🎖@cyboltx33d
Disclosure
CVE-2026-86781: https://www.cve.org/CVERecord?id=CVE-2026-86781 CVE-2026-81429: https://www.cve.org/CVERecord?id=CVE-2026-81429
Post summary
The text simply lists two CVE identifiers (CVE-2026-86781 and CVE-2026-81429) with links to their official CVE records, serving as a basic notification of their existence without technical details, exploit information, or remediation guidance.
0000024
28 followersView on X

Explore more

Back to dashboard