CVE-2026-115256— Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account Takeover

Quick assessment

Affected

Unknown Mail Debug for WooCommerce

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WooCommerce WordPress 插件"Mail Debug"在 1.3.0 及以下版本中，对其某一项邮件日志记录功能未执行任何能力（capability）、身份验证（authentication）或一次性令牌（nonce）检查。该功能暴露给未认证用户，且未限制其仅访问自身数据，导致任何人均可读取该站点发送的所有邮件的完整正文，其中包括包含密码重置密钥的密码重置邮件。攻击者可利用该重置密钥接管管理员账户。

AI Predicted 9.8 Difficulty: Trivial Updated Nov 09, 2026

Possible ATT&CK Techniques 2 AI

T1003 · OS Credential Dumping T1190 · Exploit Public-Facing Application

Updated Nov 09, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account Takeover

Source: CVE Program / CVE List V5

Vulnerability Description

The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email the site has sent, including password-reset emails whose reset key lets an attacker take over an administrator account.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Mail Debug for WooCommerce	0 ~ 1.3.0	-

II. Public POCs for CVE-2026-115256

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115256

请登录查看更多情报信息。

Other References for CVE-2026-115256 (1)

https://wpscan.com/vulnerability/79598470-4f3c-4e08-8657-c111068141d3/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-115256

Same Patch Batch · Unknown · 2026-11-09 · 23 CVEs total

CVE-2026-115252	10.0 CRITICAL	Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option
CVE-2026-106466	7.5 HIGH	JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh To
CVE-2026-106008	5.3 MEDIUM	FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass v
CVE-2026-115204		AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import
CVE-2026-115237		Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code
CVE-2026-115213		EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authenticatio
CVE-2026-115212		mView <= 1.0.3 - Subscriber+ Arbitrary File Upload
CVE-2026-120409		All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via
CVE-2026-118201		Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC
CVE-2026-118202		Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-F
CVE-2026-121759		Fusion Page Builder < 1.7.1 - Contributor+ Arbitrary Post Trashing via IDOR
CVE-2026-121874		Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name
CVE-2026-123091		Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms
CVE-2026-123064		WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalat
CVE-2026-123088		UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII
CVE-2026-123128		GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Cond
CVE-2026-121875		Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignme
CVE-2026-81422		Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registrat
CVE-2026-123129		Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Tick
CVE-2026-123131		GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Cont

Showing top 20 of 23 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Unknown