Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-119745Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download

Medium 4.3

In plain English

A medium-severity missing authorization in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce from Sender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 86.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.

Affected products (as reported)

Vendor	Product	Versions
Sender	Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce	0 – before 2.11.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

WordPress Changelog release-notes, patch
VulnCheck Advisory: Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download third-party-advisory