{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amail_debug_for_woocommerce_projectmail_debug_for_woocommercewordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mail_debug_for_woocommerce_project:mail_debug_for_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-115256"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mail Debug for WooCommerce (\u003c= 1.3.0)"],"_cs_severities":["high"],"_cs_tags":["wordpress","vulnerability","web-application"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Mail Debug for WooCommerce plugin contains a vulnerability in an email-logging function that lacks proper capability, authentication, and nonce checks. This flaw allows unauthenticated remote attackers to query the plugin's logging action to retrieve the full body of any email sent by the WordPress site. The exposure of password reset emails containing reset tokens facilitates full administrative account takeover. No patch or fixed version information is currently disclosed in the source.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read all outgoing site emails. The primary impact is the unauthorized capture of sensitive data, specifically password reset tokens, which permits full account compromise of administrative users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all WordPress instances running the \u0026quot;Mail Debug for WooCommerce\u0026quot; plugin.\u003c/li\u003e\n\u003cli\u003eDisable or remove the plugin until a patch is released by the vendor, as there are no authentication controls to mitigate this risk.\u003c/li\u003e\n\u003cli\u003eReview WordPress email logs or audit logs for unusual GET or POST requests directed at plugin-specific endpoints associated with email debugging.\u003c/li\u003e\n\u003cli\u003eReset all user credentials for administrative accounts if the site is known to have been exposed to external traffic while running vulnerable versions of this plugin.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T15:51:14Z","date_published":"2026-11-09T15:51:14Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mail-debug-woocommerce-vuln/","summary":"The Mail Debug for WooCommerce WordPress plugin up to version 1.3.0 contains an unauthenticated access vulnerability that allows attackers to read site email logs, including password reset links.","title":"Mail Debug for WooCommerce: Unauthenticated email exposure (CVE-2026-115256)","url":"https://feed.craftedsignal.io/briefs/2026-11-mail-debug-woocommerce-vuln/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:mail_debug_for_woocommerce_project:mail_debug_for_woocommerce:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}