CVE-2026-115256

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email the site has sent, including password-reset emails whose reset key lets an attacker take over an administrator account.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Unknown	Mail Debug for WooCommerce	<= 1.3.0

References

https://wpscan.com/vulnerability/79598470-4f3c-4e08-8657-c111068141d3/

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1152575.3The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing u CVE-2026-1152594.9The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post da CVE-2026-115269.8GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle.CVE-2026-1152624.8The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and colla CVE-2026-1152698.7Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthentic CVE-2026-115278.6Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in CVE-2026-1152746.9Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated atta CVE-2026-1152774.7The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML at CVE-2026-115288.8A vulnerability was found in Tenda AC18 15.03.05.05. The affected element is the function sub_45304 of the file /goform/getRebootStatus of t CVE-2026-1152816.8The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it CVE-2026-1152825.3The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe CVE-2026-1152894.3Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent