---
id: CVE-2026-119745
title: >-
  Sender WordPress Plugin < 2.11.3 Broken Access Control via
  admin_post_sender_debug_download
summary: >-
  Sender plugin for WordPress before 2.11.3 contains a missing authorization
  vulnerability that allows any authenticated user, including Subscribers, to
  access a sensitive diagnostic dump by requesting the
  admin_post_sender_debug_download …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Sender
product: 'Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce'
affected:
  - newsletter_sms_and_email_marketing_automation_for_woocommerce < 2.11.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T18:45:18.692700Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T18:45:28.642Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119745'
references:
  - url: 'https://wordpress.org/plugins/sender-net-automated-emails/#developers'
    label: WordPress Changelog
  - url: >-
      https://www.vulncheck.com/advisories/sender-wordpress-plugin-broken-access-control-via-admin-post-sender-debug-download
    label: >-
      VulnCheck Advisory: Sender WordPress Plugin < 2.11.3 Broken Access Control
      via admin_post_sender_debug_download
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.495Z'
epss: 0.00229
epssPercentile: 0.13784
---

## Overview

Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.

## Affected

- `newsletter_sms_and_email_marketing_automation_for_woocommerce < 2.11.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.