Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Sender | Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 04 Nov 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 04 Nov 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 04 Nov 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | MultiVendorX plugin for WordPress before 5.0.21 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata. | Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata. |
| Title | MultiVendorX WordPress Plugin < 5.0.21 Broken Access Control via admin_post_sender_debug_download | Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download |
| References |
|
Wed, 04 Nov 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | MultiVendorX plugin for WordPress before 5.0.21 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata. | |
| Title | MultiVendorX WordPress Plugin < 5.0.21 Broken Access Control via admin_post_sender_debug_download | |
| Weaknesses | CWE-862 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-04T18:45:28.642Z
Reserved: 2026-10-30T15:31:52.079Z
Link: CVE-2026-119745
Vulnrichment
Updated: 2026-11-04T18:45:23.795Z
NVD
Status : Deferred
Published: 2026-11-04T14:17:30.340
Modified: 2026-11-04T19:17:25.387
Link: CVE-2026-119745
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-04T16:00:17Z