Mail Debug for WooCommerce (<= 1.3.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mail-debug-for-woocommerce--1.3.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 15:51:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMail Debug for WooCommerce: Unauthenticated email exposure (CVE-2026-115256)https://feed.craftedsignal.io/briefs/2026-11-mail-debug-woocommerce-vuln/Mon, 09 Nov 2026 15:51:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mail-debug-woocommerce-vuln/The Mail Debug for WooCommerce WordPress plugin up to version 1.3.0 contains an unauthenticated access vulnerability that allows attackers to read site email logs, including password reset links.The Mail Debug for WooCommerce plugin contains a vulnerability in an email-logging function that lacks proper capability, authentication, and nonce checks. This flaw allows unauthenticated remote attackers to query the plugin's logging action to retrieve the full body of any email sent by the WordPress site. The exposure of password reset emails containing reset tokens facilitates full administrative account takeover. No patch or fixed version information is currently disclosed in the source.

Impact

Successful exploitation allows unauthenticated attackers to read all outgoing site emails. The primary impact is the unauthorized capture of sensitive data, specifically password reset tokens, which permits full account compromise of administrative users.

Recommendation

  • Identify all WordPress instances running the "Mail Debug for WooCommerce" plugin.
  • Disable or remove the plugin until a patch is released by the vendor, as there are no authentication controls to mitigate this risk.
  • Review WordPress email logs or audit logs for unusual GET or POST requests directed at plugin-specific endpoints associated with email debugging.
  • Reset all user credentials for administrative accounts if the site is known to have been exposed to external traffic while running vulnerable versions of this plugin.
]]>highadvisorywordpressvulnerabilityweb-application