WP Force SSL & HTTPS SSL Redirect

WP Force SSL & HTTPS SSL Redirect has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 4.2, and the most serious one scores 4.2 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for WP Force SSL & HTTPS SSL Redirect has a vendor fix available, so running the current release closes it.

All of these findings were reported by Foxyyy. WP Force SSL & HTTPS SSL Redirect is installed on roughly 80,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

4.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP Force SSL & HTTPS SSL Redirect vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.2CVE-2024-5770

WP Force SSL & HTTPS SSL Redirect <= 1.66 - Missing Authorization to Settings Update

Read the full analysis

Vulnerability Records

1 records


2024-06-07 00:00	WP Force SSL & HTTPS SSL Redirect <= 1.66 - Missing Authorization to Settings Update WP Force SSL & HTTPS SSL Redirect <= 1.66	`CVE-2024-5770`	4.2 Medium	Foxyyy	Yes

Showing 1–1 of 1 reports

Latestv1.70

WP Force SSL & HTTPS SSL Redirect

Author

WebFactory

4.7(179)

94/100

Last Updated

2026-08-16 (27d ago)

Active Installs

80,000+

Downloads

1,862,360

Requires WP

4.6+

Requires PHP

5.2+

Tested up to

WP 7.1

Created

2015-01-16 (12y ago)

WP Force SSL helps you redirect insecure HTTP traffic to secure HTTPS and fix SSL errors without touching any code. Activate Force SSL and everything will be set and SSL enabled. The entire site will move to HTTPS using your SSL certificate. It works with any SSL certificate. It can be free SSL certificate from Let’s Encrypt or a paid SSL certificate. How to add SSL & enable SSL? Most hosting companies support the free SSL certificate from Let’s Encrypt, so login to your hosting panel and add SSL certificate. You’ll see a button labeled “Add SSL Certificate” or “Add Let’s Encrypt Certificate” and after that it’s 1 click to have the SSL enabled on your site with WP Force SSL. If that doesn’t work get WP Force SSL PRO and it’ll generate free SSL certificate for your site. And will regenerate SSL certificate every 90 days. Access WP Force SSL settings via the main Settings menu -> WP Force SSL. SSL Tests available in the plugin is site on localhost? check SSL certificate check SSL certificate expiry date is latest version of Force SSL used? are known incompatible SSL plugins active? is WP address URL set for SSL? is WP home URL set for SSL? is SSL monitoring enabled (pro feature) is HTTPS redirection working? is file redirection working (pro feature) is HSTS enabled? check mixed-content issue (pro feature) is htaccess available & writable? is 404 redirection enabled (pro feature) Settings redirect HTTP to HTTPS fix mixed-content (pro) enable HSTS force secure cookies (pro) cross-site scripting protection (pro) expect CT header X-Frame options show WP Force SSL menu in admin bar show WP Force SSL widget in admin dashboard SSL certificate testing tool WP Force SSL comes with an SSL certificate testing tool. It tests if the SSL certificate is valid, properly installed & up-to date. Need support? We’re here for you! Things get frustrating when they don’t work so make sure you open a support topic in the official Force SSL forum. We answer all questions within a few hours! External Assets A big thank you to SweetAlert2 authors which we use to make alerts nicer. And to DepositPhotos for the lovely header image.

View on WordPress.org