---
id: "CVE-2026-119745"
kind: "vulnerability"
aliases: ["CVE-2026-119745"]
title: "MultiVendorX WordPress plugin: any logged-in user can download debug data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multivendorx", "package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["no-open-user-registration", "plugin-version-5.0.21-or-later"]
published_at: "2026-11-04T14:17:30+00:00"
first_seen_at: "2026-11-04T14:27:10+00:00"
updated_at: "2026-11-04T14:28:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119745", "first_seen_at": "2026-11-04T14:27:10+00:00"}]
---

# MultiVendorX WordPress plugin: any logged-in user can download debug data

The MultiVendorX plugin for WordPress, before version 5.0.21, lets any authenticated user, including Subscribers, download a diagnostic dump by requesting an admin action with no permission check. The dump exposes WordPress, PHP, WooCommerce and server versions, active plugins and theme, and plugin settings including the connected Sender account resource key.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MultiVendorX plugin version in the WordPress admin plugin list, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is used.
- Look for the `sender_debug_download` action in the plugin code, for example by searching for `downloadDebugFile` in the plugin directory.

## Fix

- MultiVendorX plugin for WordPress: move to `5.0.21` or later.

## Timeline

- 2026-11-04T14:27:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119745

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/multivendorx-wordpress-plugin-broken-access-control-via-admin-post-sender-debug-download

## From the sources

MultiVendorX plugin for WordPress before 5.0.21 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_