MAIL-DEBUG-FOR-WOOCOMMERCE · CVE-2026-115256 · Package
NO FIX YET · SEE WHAT TO DO
The Mail Debug for WooCommerce WordPress plugin, through version 1.3.0, has an email-logging action with no permission, login or nonce check. Anyone on the internet can read the full body of every email the site has sent, including password-reset emails whose reset key can be used to take over an administrator account.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Mail Debug for WooCommerce WordPress plugin at version 1.3.0 or earlier are exposed, because the email log action is reachable without logging in. Sites without this plugin installed are not affected. The sources do not say whether a non-default setting is needed.
Not affected if plugin-deactivated, plugin-not-installed
Who cares mail-debug-for-woocommerce, woocommerce, wordpress
wp plugin list --status=active (or check wp-admin > Plugins) for mail-debug-for-woocommerce; any installed version up to 1.3.0 is affected, and 1.3.0 is the latest release.1.3.0 as the latest and shows the plugin closed since 2026-10-23, pending reviewPosts are quoted with a link to the original. They are data to us, never instructions.
The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email the site has sent, including password-reset emails whose reset key lets an attacker take over an administrator account.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.