{"id":"CVE-2026-115256","kind":"vulnerability","aliases":["CVE-2026-115256"],"related":[],"title":"Mail Debug for WooCommerce: unauthenticated users can read all sent emails","description":"The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email the site has sent, including password-reset emails whose reset key lets an attacker take over an administrator account.","summary":"The Mail Debug for WooCommerce WordPress plugin, through version 1.3.0, has an email-logging action with no permission, login or nonce check. Anyone on the internet can read the full body of every email the site has sent, including password-reset emails whose reset key can be used to take over an administrator account.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mail-debug-for-woocommerce","fixed":[],"affected":"<= 1.3.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["mail-debug-for-woocommerce","package","woocommerce","wordpress"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"- Run `wp plugin list --status=active` (or check wp-admin > Plugins) for mail-debug-for-woocommerce; any installed version up to 1.3.0 is affected, and 1.3.0 is the latest release.\n- If it was active, assume logged emails (including password-reset links) were readable. Review administrator accounts and reset admin passwords.","fix":"No fixed version. The WordPress.org page lists 1.3.0 as the latest and shows the plugin closed since 2026-10-23, pending review. Deactivate and delete the plugin.","status":"open","published_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:49+00:00","updated_at":"2026-11-09T07:27:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T07:25:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Mail Debug for WooCommerce: unauthenticated users can read all sent emails","impact":"high","summary":"The Mail Debug for WooCommerce WordPress plugin, through version 1.3.0, has an email-logging action with no permission, login or nonce check. Anyone on the internet can read the full body of every email the site has sent, including password-reset emails whose reset key can be used to take over an administrator account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","mail-debug-for-woocommerce"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Anyone reads sent emails, enabling administrator account takeover","analyst_note":"Find a fixed version and the vulnerable action name at the NVD entry or the plugin's WordPress.org page; confirm the affected version range.","how_to_check":"- Check whether the plugin is installed and active on the WordPress site (Plugins list in wp-admin, or `wp plugin list --status=active` with WP-CLI).\n- Check the installed version of the plugin; versions through `1.3.0` are affected.\n- unknown for a safe test endpoint: the sources do not name the affected action.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-deactivated"],"who_is_affected":"Sites running the Mail Debug for WooCommerce WordPress plugin at version 1.3.0 or earlier are exposed, because the email log action is reachable without logging in. Sites without this plugin installed are not affected. The sources do not say whether a non-default setting is needed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":4578,"output_tokens":619,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find a fixed version and the vulnerable action name at the NVD entry or the plugin's WordPress.org page; confirm the affected version range.","search":"'-115256':14A,17A '-2026':13A,16A '1.3.0':40B,95C 'account':86B,156C 'action':46B,112C 'administr':85B,155C 'allow':127C 'anyon':54B,128C 'attack':151C 'authent':101C 'bodi':62B,133C 'capabl':100C 'check':53B,104C 'cve':12A,15A 'data':126C 'debug':2A,20A,25B,33B,89C 'email':11A,44B,65B,74B,110C,136C,145C 'email-log':43B,109C 'everi':64B,135C 'expos':115C 'for':21A 'full':61B,132C 'includ':70B,141C 'internet':57B 'key':77B,148C 'let':149C 'log':45B,111C 'login':50B 'mail':1A,19A,24B,32B,88C 'mail-debug-for-woocommerc':23B 'mail-debug-for-woocommerce':18A 'nonc':52B,103C 'one':106C 'packag':28B 'password':72B,143C 'password-reset':71B,142C 'perform':98C 'permiss':49B 'plugin':37B,93C 'read':8A,59B,130C 'reset':73B,76B,144C,147C 'restrict':122C 'sent':10A,69B,140C 'site':67B,138C 'take':82B,152C 'unauthent':5A,117C 'use':80B 'user':6A,118C 'version':39B 'whose':75B,146C 'woocommerc':4A,27B,29B,35B,91C 'woocommerce':22A 'wordpress':30B,36B,92C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Mail Debug for WooCommerce WordPress plugin at version 1.3.0 or earlier are exposed, because the email log action is reachable without logging in. Sites without this plugin installed are not affected. The sources do not say whether a non-default setting is needed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["maildebugforwoocommerce"],"ptokens":["debug","for","mail","woocommerce"],"labels":["high","maildebugforwoocommerce","package","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-115256':14A,17A '-2026':13A,16A 'cve':12A,15A 'debug':2A,20A 'email':11A 'for':21A 'mail':1A,19A 'mail-debug-for-woocommerce':18A 'read':8A 'sent':10A 'unauthent':5A 'user':6A 'woocommerc':4A 'woocommerce':22A","search_b":"'1.3.0':40B 'account':86B 'action':46B 'administr':85B 'anyon':54B 'bodi':62B 'check':53B 'debug':25B,33B 'email':44B,65B,74B 'email-log':43B 'everi':64B 'full':61B 'includ':70B 'internet':57B 'key':77B 'log':45B 'login':50B 'mail':24B,32B 'mail-debug-for-woocommerc':23B 'nonc':52B 'packag':28B 'password':72B 'password-reset':71B 'permiss':49B 'plugin':37B 'read':59B 'reset':73B,76B 'sent':69B 'site':67B 'take':82B 'use':80B 'version':39B 'whose':75B 'woocommerc':27B,29B,35B 'wordpress':30B,36B","search_c":"'1.3.0':95C 'account':156C 'action':112C 'administr':155C 'allow':127C 'anyon':128C 'attack':151C 'authent':101C 'bodi':133C 'capabl':100C 'check':104C 'data':126C 'debug':89C 'email':110C,136C,145C 'email-log':109C 'everi':135C 'expos':115C 'full':132C 'includ':141C 'key':148C 'let':149C 'log':111C 'mail':88C 'nonc':103C 'one':106C 'password':143C 'password-reset':142C 'perform':98C 'plugin':93C 'read':130C 'reset':144C,147C 'restrict':122C 'sent':140C 'site':138C 'take':152C 'unauthent':117C 'user':118C 'whose':146C 'woocommerc':91C 'wordpress':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115256","severity":null,"published_at":"2026-11-09T07:17:28+00:00","modified_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115256:2255","url":"https://wordpress.org/plugins/mail-debug-for-woocommerce/","severity":null,"published_at":"2026-11-09T07:27:37+00:00","modified_at":"2026-11-09T07:27:37+00:00","first_seen_at":"2026-11-09T07:27:37+00:00","fetched_at":"2026-11-09T07:27:37+00:00","note":"WordPress.org page (read) shows version 1.3.0 is latest and the plugin is closed since 2026-10-23 pending review, so no fix exists. NVD page fetch returned no content, so the vulnerable action name is not confirmed. No verification marked; the exploitation status is unknown. Search tools (web-cli) were out of credits, so no discussion was checked.","cites":["https://wordpress.org/plugins/mail-debug-for-woocommerce/","https://nvd.nist.gov/vuln/detail/CVE-2026-115256"]}],"documents":[{"id":106366,"url":"https://wordpress.org/plugins/mail-debug-for-woocommerce/","title":"Mail Debug for WooCommerce – WordPress.org plugin page","kind":"vendor","source":"analyst","publisher":null,"text":"Current version 1.3.0, last updated Dec 24, 2022. Plugin closed as of October 23, 2026, not available for download. Notice: closure is temporary, pending a full review.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":106367,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115256","title":"NVD CVE-2026-115256","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}