Email Logging Vulnerability in WooCommerce Plugin by WordPress
CVE-2026-115256
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-115256?
The Mail Debug for WooCommerce plugin, version 1.3.0, lacks essential authentication and capability checks on its email-logging functionality. This oversight allows unauthenticated users to access sensitive information, exposing the contents of every email sent by the site. Notably, this includes critical communications such as password-reset emails, which could facilitate unauthorized access to administrator accounts.
Affected Version(s)
Mail Debug for WooCommerce 0 <= 1.3.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.