{"id":"CVE-2026-119745","kind":"vulnerability","aliases":["CVE-2026-119745"],"related":[],"title":"MultiVendorX WordPress plugin: any logged-in user can download debug data","description":"MultiVendorX plugin for WordPress before 5.0.21 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.","summary":"The MultiVendorX plugin for WordPress, before version 5.0.21, lets any authenticated user, including Subscribers, download a diagnostic dump by requesting an admin action with no permission check. The dump exposes WordPress, PHP, WooCommerce and server versions, active plugins and theme, and plugin settings including the connected Sender account resource key.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multivendorx","package","self-hosted","woocommerce","wordpress"],"not_affected_if":["no-open-user-registration","plugin-version-5.0.21-or-later"],"how_to_check":"- Check the installed MultiVendorX plugin version in the WordPress admin plugin list, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is used.\n- Look for the `sender_debug_download` action in the plugin code, for example by searching for `downloadDebugFile` in the plugin directory.","fix":"- MultiVendorX plugin for WordPress: move to `5.0.21` or later.","status":"open","published_at":"2026-11-04T14:17:30+00:00","first_seen_at":"2026-11-04T14:27:10+00:00","triaged_at":"2026-11-04T14:28:19+00:00","updated_at":"2026-11-04T14:28:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T14:28:19Z","model":"claude-haiku-5-5","output":{"fix":"- MultiVendorX plugin for WordPress: move to `5.0.21` or later.","reach":"internet","title":"MultiVendorX WordPress plugin: any logged-in user can download debug data","impact":"medium","summary":"The MultiVendorX plugin for WordPress, before version 5.0.21, lets any authenticated user, including Subscribers, download a diagnostic dump by requesting an admin action with no permission check. The dump exposes WordPress, PHP, WooCommerce and server versions, active plugins and theme, and plugin settings including the connected Sender account resource key.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","multivendorx","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads server versions, plugin settings and the Sender account resource key","analyst_note":"","how_to_check":"- Check the installed MultiVendorX plugin version in the WordPress admin plugin list, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is used.\n- Look for the `sender_debug_download` action in the plugin code, for example by searching for `downloadDebugFile` in the plugin directory.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-5.0.21-or-later","no-open-user-registration"],"who_is_affected":"Sites running the MultiVendorX plugin before 5.0.21 with user accounts that a visitor can register or obtain, such as Subscribers on a WooCommerce marketplace. Sites that do not run this plugin, or that have no way for outsiders to get a logged-in account, are less exposed. The sources do not say whether the Sender integration must be enabled for the debug action to be reachable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4260,"output_tokens":663,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119745':15A,18A '-2026':14A,17A '/admin-post.php':128C '5.0.21':33B,81C 'access':95C 'account':73B,157C,161C 'action':48B,108C,129C 'activ':62B,144C,147C 'admin':47B,103C,127C 'allow':88C 'attack':119C 'authent':36B,90C 'author':85C 'capabl':114C 'check':52B,118C 'connect':71B,155C 'contain':82C 'cve':13A,16A 'data':12A 'debug':11A,106C,131C 'detail':141C 'diagnost':42B,98C 'download':10A,40B,107C,132C 'downloaddebugfil':111C 'dump':43B,54B,99C 'exploit':121C 'expos':55B 'flaw':123C 'full':143C 'handl':109C 'host':23B 'includ':38B,69B,92C,153C 'inform':149C 'inventori':146C 'key':75B,159C 'let':34B 'log':6A 'logged-in':5A 'metadata':162C 'miss':84C 'multivendorx':1A,19B,27B,76C 'nonc':115C 'packag':20B 'permiss':51B 'php':57B,136C 'plugin':3A,28B,63B,67B,77C,145C,151C 'post':104C 'refer':117C 'request':45B,101C 'resourc':74B,158C 'retriev':134C 'self':22B 'self-host':21B 'sender':72B,105C,130C,156C 'sensit':97C 'server':60B,139C 'set':68B,152C 'subscrib':39B,93C 'theme':65B,148C 'user':8A,37B,91C 'version':32B,61B,140C 'via':124C 'vulner':86C 'without':112C 'woocommerc':24B,58B,137C 'wordpress':2A,25B,30B,56B,79C,135C 'wp':126C 'wp-admin':125C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MultiVendorX plugin before 5.0.21 with user accounts that a visitor can register or obtain, such as Subscribers on a WooCommerce marketplace. Sites that do not run this plugin, or that have no way for outsiders to get a logged-in account, are less exposed. The sources do not say whether the Sender integration must be enabled for the debug action to be reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","multivendorx","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T14:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119745","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119745","severity":null,"published_at":"2026-11-04T14:17:30+00:00","modified_at":"2026-11-04T14:17:31+00:00","first_seen_at":"2026-11-04T14:27:10+00:00","fetched_at":"2026-11-04T14:27:10+00:00","note":null}],"documents":[{"id":67450,"url":"https://www.vulncheck.com/advisories/multivendorx-wordpress-plugin-broken-access-control-via-admin-post-sender-debug-download","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}