The Sender plugin for WordPress versions before 2.11.3 contains a missing authorization check that permits any authenticated user, even those with Subscriber privileges, to invoke the admin_post_sender_debug_download action. When this action is called, the downloadDebugFile function outputs a detailed diagnostic dump that includes WordPress, PHP, WooCommerce, and server version numbers, the entire active plugin list, the active theme data, and configuration values such as the Sender account resource key. Because no capability, nonce, or referer validation is performed, an attacker can retrieve sensitive information that could be leveraged for further attacks. The weakness is classified as CWE‑862.

WordPress sites running the Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin at a version lower than 2.11.3. Any installation that relies on this plugin for email automation is affected; the core WordPress or WooCommerce components themselves are not directly impacted.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The most probable attack vector is a straightforward POST request to wp-admin/admin-post.php?action=sender_debug_download, which any authenticated user can perform. Because the request bypasses authorization controls, exploitation is trivial, and the exposed data could aid credential harvesting, phishing, or target‑specific attacks.