CVE-2026-119745 in MultiVendorX Plugin
Summary
by MITRE • 11/04/2026
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in the Sender plugin for WordPress prior to version 2.11.3 represents a critical failure in access control mechanisms, specifically classified under CWE-862 as Missing Authorization. This flaw allows any authenticated user on a WordPress installation, regardless of their assigned role or capability level, including those with the lowest privilege tier such as Subscribers, to execute administrative functions intended exclusively for high-level administrators. The core technical issue lies in the handling of the admin_post_sender_debug_download action by the downloadDebugFile() function within the plugin code. This endpoint is designed to generate and serve a diagnostic dump containing sensitive system information, yet it fails to implement essential security checks such as capability verification using WordPress functions like current_user_can(), nonce validation via check_admin_referer or wp_verify_nonce, or referer header inspection. Consequently, the authentication state of the user session is insufficiently validated against the required permissions for accessing administrative diagnostic tools.
From an operational perspective, this vulnerability enables a low-privilege attacker to exfiltrate comprehensive environmental intelligence about the target WordPress instance and its underlying infrastructure. By crafting a specific HTTP POST request to wp-admin/admin-post.php?action=sender_debug_download, an attacker can retrieve detailed information including the versions of WordPress core, PHP runtime, WooCommerce plugin, and the web server software in use. Furthermore, the diagnostic dump exposes the full inventory of active plugins along with their version numbers, which aids attackers in identifying other potential vulnerabilities within the same environment. The exposure extends to theme details and specific configuration settings for the Sender plugin itself. Most critically, this includes sensitive credentials such as the connected Sender account resource key and associated account metadata. This level of information disclosure significantly lowers the barrier for subsequent attacks by providing a detailed map of the attack surface and valid authentication tokens that can be leveraged for further exploitation or unauthorized access to external services linked via the plugin.
The impact of this vulnerability aligns with several techniques in the MITRE ATT&CK framework, particularly T1087 Account Discovery and T1592 Gather Victim Host Information. The ability to enumerate user roles and capabilities through the exposure of administrative endpoints contributes to account discovery efforts, while the retrieval of software versions and plugin inventories directly supports host information gathering for pre-exploitation reconnaissance. Additionally, since the vulnerability involves accessing sensitive data without proper authorization, it also relates to T1530 Data from Cloud Storage if the diagnostic file is stored or transmitted insecurely, although the primary vector here is direct access via the web application interface. The exposure of API keys and resource tokens poses a severe risk as these credentials can be used to interact with external email service providers, potentially leading to spam distribution, phishing campaigns using trusted sender identities, or further compromise if those accounts have broader permissions elsewhere in an organization's infrastructure.
Mitigation for this vulnerability requires immediate upgrading the Sender plugin to version 2.11.3 or later where these authorization checks are properly implemented. In environments where patching is not immediately feasible, administrators should restrict access to wp-admin/admin-post.php through web application firewall rules that limit POST requests from untrusted sources or enforce strict IP whitelisting for administrative endpoints if applicable. Additionally, implementing robust role-based access control plugins can help ensure that sensitive actions are only accessible by users with explicit administrator privileges. Regular security audits and code reviews focusing on input validation and authorization checks in custom plugin development practices are essential to prevent similar issues. Organizations should also monitor logs for unusual POST requests targeting admin-post.php endpoints from low-privilege user accounts as an indicator of potential exploitation attempts.