---
id: "CVE-2026-115256"
page: "https://infrastack.ai/live/CVE-2026-115256"
kind: "vulnerability"
aliases: ["CVE-2026-115256"]
title: "Mail Debug for WooCommerce: unauthenticated users can read all sent emails"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mail-debug-for-woocommerce", "fixed": [], "affected": "<= 1.3.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["mail-debug-for-woocommerce", "package", "woocommerce", "wordpress"]
not_affected_if: ["plugin-deactivated", "plugin-not-installed"]
published_at: "2026-11-09T07:17:28+00:00"
first_seen_at: "2026-11-09T07:25:04+00:00"
updated_at: "2026-11-09T07:27:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115256", "first_seen_at": "2026-11-09T07:25:04+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/mail-debug-for-woocommerce/", "first_seen_at": "2026-11-09T07:27:37+00:00", "cites": ["https://wordpress.org/plugins/mail-debug-for-woocommerce/", "https://nvd.nist.gov/vuln/detail/CVE-2026-115256"]}]
exploit_sources: []
---

# Mail Debug for WooCommerce: unauthenticated users can read all sent emails

Link for people: https://infrastack.ai/live/CVE-2026-115256 (this .md is for agents)

The Mail Debug for WooCommerce WordPress plugin, through version 1.3.0, has an email-logging action with no permission, login or nonce check. Anyone on the internet can read the full body of every email the site has sent, including password-reset emails whose reset key can be used to take over an administrator account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:mail-debug-for-woocommerce affected <= 1.3.0 fixed no fixed version listed

## How to check

- Run `wp plugin list --status=active` (or check wp-admin > Plugins) for mail-debug-for-woocommerce; any installed version up to 1.3.0 is affected, and 1.3.0 is the latest release.
- If it was active, assume logged emails (including password-reset links) were readable. Review administrator accounts and reset admin passwords.

## Fix

No fixed version. The WordPress.org page lists 1.3.0 as the latest and shows the plugin closed since 2026-10-23, pending review. Deactivate and delete the plugin.

## Timeline

- 2026-11-09T07:25:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115256
- 2026-11-09T07:27:37+00:00 analyst https://wordpress.org/plugins/mail-debug-for-woocommerce/ — WordPress.org page (read) shows version 1.3.0 is latest and the plugin is closed since 2026-10-23 pending review, so no fix exists. NVD page fetch returned no content, so the vulnerable action name is not confirmed. No verification marked; the exploitation status is unknown. Search tools (web-cli) were out of credits, so no discussion was checked.

## Documents

- [advisory] Mail Debug for WooCommerce – WordPress.org plugin page https://wordpress.org/plugins/mail-debug-for-woocommerce/
- [describes] NVD CVE-2026-115256 https://nvd.nist.gov/vuln/detail/CVE-2026-115256

## From the sources

The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email the site has sent, including password-reset emails whose reset key lets an attacker take over an administrator account.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_