CVE-2026-17602 is a CWE-22 directory traversal vulnerability in the SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin. It affects all plugin versions from 0 through 4.7.42. The vulnerability arises from improper limitation of pathname inputs via the 'file_name' parameter, enabling authenticated administrators to read arbitrary files on the server. This can lead to disclosure of sensitive data. The CVSS 3.1 base score is 4.9, indicating a medium severity with network attack vector, low attack complexity, and high privileges required. No known exploits are reported in the wild. No patch or remediation information is provided in the source data.

An authenticated attacker with administrator-level access can exploit this vulnerability to read arbitrary files on the server. This may result in disclosure of sensitive information, potentially compromising confidentiality. There is no indication of impact on integrity or availability. The attack requires high privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing sensitive files on the server where possible.