The Mail Debug for WooCommerce plugin up to version 1.3.0 allows any visitor to access a logging endpoint without permission. The endpoint returns the full body of all emails the WordPress site has sent, including keys for password‑reset emails. Exposure of these keys enables an attacker to assume administrative control of the site, effectively taking over the account.

Any WordPress site running the Mail Debug for WooCommerce plugin at or below version 1.3.0 is impacted. The vendor is not publicly listed, but the plugin is available through the WordPress repository.

The flaw can be triggered by unauthenticated users visiting the specific URL that exposes the logging data. No additional authentication, privilege, or network restrictions are required. While no CVSS score is provided, the severity is effectively critical because a single reset key grants full administrative access. The EPSS score is not available, and the vulnerability is not currently listed in CISA KEV, but the attack path is straightforward and the impact catastrophic.