CVE-2026-104643: CWE-862 Missing Authorization in Easy HTTPS Redirection (SSL)

CVE-2026-104643 is a missing authorization vulnerability (CWE-862) in the Easy HTTPS Redirection (SSL) WordPress plugin prior to version 2.0.2. The plugin fails to perform proper capability checks on certain AJAX actions, enabling any authenticated user to read sensitive URL data gathered from private and draft posts and site options. Furthermore, these users can initiate a site-wide URL rewrite operation once an administrator has executed a scan. This issue arises from insufficient access control in the plugin's AJAX endpoints.

Any authenticated user, including those with minimal privileges such as Subscribers, can access sensitive URL information from private and draft content and site options. They can also trigger site-wide URL rewrites, which could lead to unintended site behavior or configuration changes. However, exploitation requires an authenticated user and an administrator to have run a scan beforehand.

A fixed version 2.0.2 of the Easy HTTPS Redirection (SSL) plugin addresses this vulnerability by adding proper capability checks to the affected AJAX actions. Users should upgrade to version 2.0.2 or later to remediate this issue. No other mitigation steps are indicated.