CVE-2024-1076: SSL Zen <= 4.5.3 - Unauthenticated Private Keys Access

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-05-08 · updated 2026-06-17
Weakness: CWE-306

Description

The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who doesn't support .htaccess files, like NGINX.

Affected products

SSL Zen: before 4.6.0 — fixed in 4.6.0

How to fix

Upgrade to a fixed version: SSL Zen 4.6.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/9c3e9c72-3d6c-4e2c-bb8a-f4efce1371d5/
https://wpscan.com/vulnerability/9c3e9c72-3d6c-4e2c-bb8a-f4efce1371d5/

Get alerted when CVE-2024-1076 or the next vulnerability affects your stack