CVE-2026-119745

Name of the Vulnerable Software and Affected Versions Sender plugin for WordPress versions prior to 2.11.3 MultiVendorX plugin for WordPress versions prior to 5.0.21

Description A missing authorization flaw allows any authenticated user, such as those with Subscriber roles, to access a sensitive diagnostic dump. This occurs when the downloadDebugFile() function handles the admin post sender debug download action without verifying capabilities, nonces, or referer headers. An attacker can use the endpoint wp-admin/admin-post.php?action=sender debug download to retrieve server version details, PHP, WordPress, and WooCommerce versions, the complete list of active plugins and themes, and plugin settings, including the Sender account resource key and account metadata.

Recommendations Update Sender plugin for WordPress to version 2.11.3 or later. Update MultiVendorX plugin for WordPress to version 5.0.21 or later.