CVE-2026-104643 Details
Description
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.
A vulnerability exists in the Easy HTTPS Redirection (SSL) WordPress plugin in versions prior to 2.0.2. The plugin fails to implement proper capability checks for certain AJAX actions. This oversight allows any authenticated user, including Subscribers, to access URLs collected by the plugin's content scanner from private and draft posts, as well as from site options. Additionally, these users can initiate a site-wide rewrite of the scanned URLs, but only after an administrator has performed a scan.
Users are advised to update the Easy HTTPS Redirection (SSL) WordPress plugin to version 2.0.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/8b75ec7a-2b37-4e77-a83a-18b5e6f71d51/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Easy HTTPS Redirection | < 2.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |