Unauthorized Access Vulnerability in Easy HTTPS Redirection Plugin for WordPress
CVE-2026-104643

Currently unrated

Key Information:

Vendor

WordPress
Status
Easy Https Redirection (ssl)
Vendor
CVE Published:
15 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-104643?

The Easy HTTPS Redirection (SSL) plugin for WordPress, prior to version 2.0.2, is vulnerable due to the lack of capability checks in certain AJAX actions. This security issue permits authenticated users, including those with Subscriber privileges, to access sensitive data such as URLs gathered from private and draft posts. Furthermore, these users can instigate a website-wide rewrite of these URLs, posing significant risks to site security. It is recommended that users update to the latest version to mitigate these risks.

Affected Version(s)

Easy HTTPS Redirection (SSL) 0 < 2.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-104643 - Proof of Concept

References

https://wpscan.com/vulnerability/8b75ec7a-2b37-4e77-a83a-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohammed Abd Alrahman
WPScan
.