CVE-2026-115831 · Package
NO FIX YET · SEE WHAT TO DO
The VOD Infomaniak plugin for WordPress up to and including 1.5.15 lacks a permission check on an AJAX handler. An authenticated subscriber can start video imports using the site owner's Infomaniak API credentials, consuming their quota and inserting rows that change which videos public shortcodes display.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the VOD Infomaniak plugin version 1.5.15 or earlier that allow users with subscriber accounts to log in. The flaw needs a logged-in account but no elevated role, so sites with open registration or many low-privilege users are most exposed. Sites without this plugin, or with it removed, are not affected.
Not affected if no-subscriber-accounts, plugin-not-installed, registration-closed
Who cares self-hosted, vod-infomaniak, wordpress
1.5.15 or lower.wp_vod_upload table in the WordPress database.The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to initiate unauthorized video imports using the site owner's Infomaniak API credentials, consume the site owner's VOD account quota, and insert arbitrary rows into the wp_vod_upload table causing public shortcodes to resolve to attacker-chosen video content. This action is explicitly reserved for Contributor-level and above by the plugin's own role-rights system, meaning subscriber access is intentionally forbidden by design — the AJAX handler simply omits the enforcement.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.