CVE-2026-119745
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
61/100
Published: 2026-11-04
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
X
AT:
None
VC:
Low
VI:
None
VA:
None
Description
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| Sender | Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce | 0 < 2.11.3 |
| Sender | Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce | 0 < 2.11.3 |
| Sender | Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce | 0 < 2.11.3 |
References & Advisories (4)
third-party-advisory
release-notes
patch