CVE-2026-119745 · Package
NO FIX YET · SEE WHAT TO DO
The MultiVendorX plugin for WordPress, before version 5.0.21, lets any authenticated user, including Subscribers, download a diagnostic dump by requesting an admin action with no permission check. The dump exposes WordPress, PHP, WooCommerce and server versions, active plugins and theme, and plugin settings including the connected Sender account resource key.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the MultiVendorX plugin before 5.0.21 with user accounts that a visitor can register or obtain, such as Subscribers on a WooCommerce marketplace. Sites that do not run this plugin, or that have no way for outsiders to get a logged-in account, are less exposed. The sources do not say whether the Sender integration must be enabled for the debug action to be reachable.
Not affected if no-open-user-registration, plugin-version-5.0.21-or-later
Who cares multivendorx, self-hosted, woocommerce, wordpress
wp plugin get <plugin-slug> --field=version if WP-CLI is used.sender_debug_download action in the plugin code, for example by searching for downloadDebugFile in the plugin directory.5.0.21 or later.MultiVendorX plugin for WordPress before 5.0.21 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
This page as .md · .json · in your agent: get_signal("CVE-2026-119745") · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.