Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-119745

Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download

CVSS 4.0 5.3 MEDIUMCVSS 3.1 4.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-119745

Published

Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-119745

Published

Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "vendor": "Sender",
                    "product": "Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver",
                            "lessThan": "2.11.3"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON