CVE-2026-119745 Details
Description
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
A missing authorization vulnerability has been identified in the MultiVendorX plugin for WordPress, affecting versions prior to 5.0.21. This vulnerability allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump. The issue arises because the admin_post_sender_debug_download action, managed by the downloadDebugFile() function, lacks proper capability, nonce, and referer checks. Exploitation of this vulnerability involves sending a request to wp-admin/admin-post.php?action=sender_debug_download, which retrieves detailed information about the WordPress and PHP versions, WooCommerce and server details, the full list of active plugins, active theme information, and specific plugin settings, including the connected Sender account resource key and account metadata.
Users are advised to update the MultiVendorX WordPress plugin to version 5.0.21 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MultiVendorX | < 5.0.21 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | CVE Modified | [email protected] |
| Nov 4, 2026 | New CVE Received | [email protected] |