The Easy HTTPS Redirection (SSL) WordPress plugin fails to enforce capability checks for certain AJAX operations. As a result, any authenticated user, including users with the Subscriber role, can invoke these functions. An attacker can read URLs that the plugin gathered during a site scan – URLs from private or draft posts and from site options – exposing sensitive internal links. The same flaw allows the user to trigger a site‑wide rewrite of those URLs once an administrator has executed a scan, leading to unintended alterations of site links and navigation structures.

WordPress sites running the Easy HTTPS Redirection (SSL) plugin, versions prior to 2.0.2. The vendor is unknown; the plugin is listed as "Easy HTTPS Redirection (SSL)" in WordPress plugin repositories. All releases before the 2.0.2 update are affected.

The vulnerability offers attackers the ability to access confidential information and modify site content without administrative privileges. The CVSS score is not specified, but the lack of EPSS data and absence in the CISA KEV suggests a moderate to high risk that may be exploited by authenticated attackers. The attack vector is authenticated, requiring a valid user account – a role as low as Subscriber can exploit it once they have access to the site. This combination of low privilege requirement and powerful impact warrants serious attention.