← CVE Radar
CVE-2026-119745Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
5.3 MEDIUMEPSS 0.22%Not in KEVNVD: Deferred
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 5.3 | MEDIUM | 4.0VulnCheck (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| 4.3 | MEDIUM | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Details
- CVE ID
- CVE-2026-119745
- Status
- Deferred
- Assigner (CNA)
- VulnCheck
- Published
- Nov 4, 2026
- Last modified
- 2026-11-04 19:17 UTC
- Weaknesses
- CWE-862 · Missing Authorization
Affected Products
As published by the CNA in the CVE record.
SenderSender – Newsletter, SMS and Email Marketing Automation for WooCommerce1 version range
- before 2.11.3