Auth bypass in Sender – Newsletter, Sms And Email Marketing Automation For Woocommerce
CVE-2026-119745
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- wordpress.org/plugins/dc-woocommerce-multi-vendor/
- www.vulncheck.com/advisories/multivendorx-wordpress-plugin-broken-access-contro…
- wordpress.org/plugins/sender-net-automated-emails/ (release-notes, patch)
- www.vulncheck.com/advisories/sender-wordpress-plugin-broken-access-control-via-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-119745?
- CVE-2026-119745 is a medium-severity vulnerability in Sender – Newsletter, Sms And Email Marketing Automation For Woocommerce, classified under Missing Authorization. CVSS score: 4.3/10. Published 2026-11-04.
- How severe is CVE-2026-119745?
- Medium severity. CVSS v3 base score is 4.3 out of 10.