CVE-2026-119745
Deferred Deferred - Pending Action

MultiVendorX Plugin Missing Authorization to Debug File Download

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-119745
EUVD
EUVD-2026-116913

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MultiVendorX MultiVendorX 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the MultiVendorX WordPress plugin before version 5.0.21. It allows any authenticated user, even low-privilege ones like Subscribers, to access sensitive diagnostic information without proper authorization checks. By sending a specific request to wp-admin/admin-post.php, attackers can download details about WordPress, PHP, WooCommerce, and server versions, active plugins and themes, and plugin settings including account keys and metadata.

Detection Guidance

Check for unauthorized access to the admin_post_sender_debug_download endpoint by reviewing server logs for requests to wp-admin/admin-post.php?action=sender_debug_download. Look for any successful responses containing sensitive diagnostic data like WordPress, PHP, WooCommerce versions, plugin inventory, or account metadata.

Impact Analysis

Attackers could exploit this to gather detailed system information about your WordPress site, which may help them plan further attacks. They could also obtain sensitive plugin settings, including connected account credentials or metadata, potentially leading to unauthorized access or data breaches. The exposure of version details might allow attackers to target known vulnerabilities in specific software versions.

Mitigation Strategies

Update the MultiVendorX plugin to version 5.0.21 or later immediately. Review server logs for any signs of exploitation attempts. Consider temporarily disabling the plugin if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119745. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...