Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-04
Sender Net Automated Emails - Security Vulnerability (CVE-2026-119745)
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
PLUGIN
Sender Net Automated Emails
CVE-2026-119745
Risk Score
Threat Entry
Updated 2026-07-27
Sender Net Automated Emails - SQL Injection (CVE-2026-59537)
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
PLUGIN
Sender Net Automated Emails
CVE-2026-59537
Risk Score