CVE-2026-115256: Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account Takeover

Q: Who can exploit this issue?

Any unauthenticated user can access the affected email-logging action. No WordPress account, capability, or nonce is required.

Q: What sensitive data may be exposed?

An attacker can read the full body of every email sent by the site. This can include password-reset emails containing reset keys that may be used to take over an administrator account.

Q: Are sites affected by default?

The issue is in an email-logging action exposed by the plugin through version 1.3.0. The provided information does not identify any configuration prerequisite or access restriction that would prevent unauthenticated access.

Q: How can an attacker turn the disclosure into account takeover?

The attacker can obtain a password-reset email from the exposed sent-email log and use its reset key to reset the associated administrator account password.

Published Nov 9, 2026

Updated

The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email the site has sent, including password-reset emails whose reset key lets an attacker take over an administrator account.

Affected Software

1 affected component

Mail Debug for WooCommerce<=1.3.0

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated user can access the affected email-logging action. No WordPress account, capability, or nonce is required.

What sensitive data may be exposed?

An attacker can read the full body of every email sent by the site. This can include password-reset emails containing reset keys that may be used to take over an administrator account.

Are sites affected by default?

The issue is in an email-logging action exposed by the plugin through version 1.3.0. The provided information does not identify any configuration prerequisite or access restriction that would prevent unauthenticated access.

How can an attacker turn the disclosure into account takeover?

The attacker can obtain a password-reset email from the exposed sent-email log and use its reset key to reset the associated administrator account password.

CVE-2026-115256: Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account Takeover

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What sensitive data may be exposed?

Are sites affected by default?

How can an attacker turn the disclosure into account takeover?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What sensitive data may be exposed?

Are sites affected by default?

How can an attacker turn the disclosure into account takeover?