blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-119745

MEDIUM 5.3 CVSS 4.0
Published
November 4, 2026
Last modified
November 4, 2026
NVD status
Deferred
Reported by
disclosure@vulncheck.com
Weakness
CWE-862
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.

Affected WordPress components

  • Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce Plugin · sender-net-automated-emails
    Confirmed match Active
    Before 2.11.3
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce — Before 2.11.3

References

  • wordpress.org https://wordpress.org/plugins/sender-net-automated-emails/#developers
  • www.vulncheck.com https://www.vulncheck.com/advisories/sender-wordpress-plugin-broken-access-control-via-admin-post-sender-debug-download
  • nvd.nist.gov Official NVD record