CVE-2026-104643 in Easy HTTPS Redirection Plugin
Summary
by MITRE • 10/15/2026
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in the Easy HTTPS Redirection (SSL) WordPress plugin prior to version 2.0.2 represents a critical failure in access control mechanisms within its AJAX handler architecture. This flaw stems from the absence of proper capability verification for specific administrative functions that are exposed through public-facing endpoints. In secure web application design, particularly within content management systems like WordPress, any action that modifies site configuration or accesses sensitive data must be strictly gated by role-based permissions. The plugin fails to enforce these checks on several AJAX actions, effectively allowing authenticated users with the lowest privilege level, such as Subscribers, to interact with functionality intended exclusively for administrators. This misconfiguration creates a direct pathway for unauthorized access and manipulation of critical site settings, undermining the fundamental security model that relies on user roles to segregate privileges.
The operational impact of this vulnerability is twofold, involving both information disclosure and remote code execution-like effects through configuration tampering. First, an attacker can exploit the lack of checks to read URLs collected by the plugin's content scanner. These scans often traverse private posts, draft entries, and various site options that are not intended for public consumption or even standard user visibility. By accessing these endpoints, a low-privileged user can extract sensitive data regarding the internal structure of the website, including unpublished content and configuration details stored in site options. This information leakage provides an attacker with valuable intelligence about the target environment, potentially revealing paths to further exploitation or identifying high-value targets within the CMS architecture.
Secondly, and more critically, the vulnerability allows any authenticated user to trigger a site-wide rewrite of URLs based on the data collected during scans performed by administrators. Since the plugin is designed to redirect HTTP traffic to HTTPS, an attacker can manipulate this process to alter how links are resolved across the entire website. By forcing these rewrites without authorization, an attacker could potentially break legitimate functionality, create phishing opportunities through manipulated redirects, or disrupt service availability for other users. This capability effectively grants a low-privileged user administrative control over the site's routing logic, which can lead to significant operational disruption and compromise the integrity of the web application's navigation structure.
From a classification perspective, this vulnerability aligns with CWE-862, Missing Authorization, as it involves the failure to enforce proper access controls on sensitive operations. It also relates closely to CWE-798, Use of Hard-coded Credentials or Default Passwords in some contexts if default roles are exploited, but primarily falls under improper privilege management. In terms of the MITRE ATT&CK framework for enterprise security, this behavior is indicative of T1078, Valid Accounts, where an attacker uses legitimate credentials to gain access, and potentially T1496, Resource Hijacking or T1530, Data from Cloud Storage Object if data exfiltration occurs. The scenario describes a classic case of insecure direct object references combined with broken access control, allowing lateral movement within the application's privilege hierarchy.
To mitigate this vulnerability, immediate action is required to update the Easy HTTPS Redirection (SSL) plugin to version 2.0.2 or later, where these capability checks have been implemented by the developers. Until an upgrade can be performed, administrators should consider restricting access to WordPress admin-ajax.php for users with subscriber-level privileges if possible, although this may impact legitimate functionality depending on other plugins in use. Additionally, implementing a Web Application Firewall (WAF) with rules that monitor and restrict AJAX requests from low-privileged accounts attempting to invoke administrative endpoints can provide an additional layer of defense. Regular auditing of plugin code for proper capability verification is essential to prevent similar issues, ensuring that all actions modifying site state or accessing sensitive data are strictly limited to users with the appropriate administrator-level permissions.