CVE-2026-119745: MultiVendorX WordPress Plugin < 5.0.21 Broken Access Control via admin_post_sender_debug_download
MultiVendorX plugin for WordPress before 5.0.21 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the adminpostsenderdebugdownload action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=senderdebugdownload to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
Other sources
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the adminpostsenderdebugdownload action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=senderdebugdownload to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
— NVD
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MultiVendorX WordPress Pluginto a version that resolves this vulnerability.Fixed in 5.0.21 - Upgrade
Upgrade
Sender plugin for WordPressto a version that resolves this vulnerability.Fixed in 2.11.3
Event History
Frequently Asked Questions
Which users can retrieve the diagnostic dump?
Any authenticated WordPress user can access it, including users with the Subscriber role. No elevated WordPress capability is required.
What does an attacker need to exploit this issue?
The attacker needs a valid authenticated WordPress account and can request wp-admin/admin-post.php?action=sender_debug_download. The vulnerable handler does not require a capability check, nonce, or referer check.
What information may be exposed?
The diagnostic dump can disclose WordPress, PHP, WooCommerce, and server version details; the active plugin inventory and theme; and plugin settings. It may also expose the connected Sender account resource key and account metadata.
Which versions should be updated?
MultiVendorX versions before 5.0.21 and Sender plugin for WordPress versions before 2.11.3 are affected. Update to the stated fixed version or later.