{"id":"CVE-2026-121761","kind":"vulnerability","aliases":["CVE-2026-121761"],"related":[],"title":"Infomaniak VOD WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VOD Infomaniak: from n/a through 1.5.15.","summary":"The VOD Infomaniak plugin is missing an authorization check, so access control settings can be exploited when configured incorrectly. The sources say the flaw affects versions up to and including 1.5.15 and rate it medium (CVSS 4.3).","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infomaniak","other","vod-infomaniak","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-above-1.5.15"],"how_to_check":"- Check the installed version of the VOD Infomaniak plugin (`vod-infomaniak`) in the plugin list\n- Compare it against the affected range: through `1.5.15`","fix":"- Move to a version later than `1.5.15`; the sources do not name the fixed version","status":"open","published_at":"2026-11-07T09:17:13+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","triaged_at":"2026-11-07T09:48:03+00:00","updated_at":"2026-11-07T09:48:03+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-07T09:48:03Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `1.5.15`; the sources do not name the fixed version","reach":"unknown","title":"Infomaniak VOD WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"The VOD Infomaniak plugin is missing an authorization check, so access control settings can be exploited when configured incorrectly. The sources say the flaw affects versions up to and including 1.5.15 and rate it medium (CVSS 4.3).","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","vod-infomaniak","infomaniak"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may reach restricted plugin functions or content","analyst_note":"Find the vendor advisory or the plugin changelog naming the first fixed version and the exact access control setting involved; the NVD entry gives only the affected range.","how_to_check":"- Check the installed version of the VOD Infomaniak plugin (`vod-infomaniak`) in the plugin list\n- Compare it against the affected range: through `1.5.15`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-1.5.15"],"who_is_affected":"Sites running the VOD Infomaniak video-on-demand plugin at version 1.5.15 or earlier are in the affected range, mainly where access control is configured in a way the flaw can exploit. Sites that do not use this plugin are not affected. unknown whether the sources name a specific required configuration.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000719,"input_tokens":4225,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121761':13A,16A '-2026':12A,15A '1.5.15':53B,86C '4.3':59B 'access':9A,33B,75C 'affect':47B,80C 'allow':71C 'author':6A,30B,61C 'check':7A,31B 'configur':40B,74C 'control':10A,34B,76C 'cve':11A,14A 'cvss':58B 'exploit':38B,72C 'expos':8A 'flaw':46B 'includ':52B 'incorrect':41B,73C 'infomaniak':1A,17B,21B,25B,64C,67C,70C,82C 'issu':79C 'levels.this':78C 'medium':57B 'miss':5A,28B,60C 'n/a':84C 'network':65C 'plugin':4A,26B 'rate':55B 'say':44B 'secur':77C 'set':35B 'sourc':43B 'version':48B 'vod':2A,20B,24B,66C,69C,81C 'vod-infomaniak':19B,68C 'vulner':62C 'wordpress':3A,22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the VOD Infomaniak video-on-demand plugin at version 1.5.15 or earlier are in the affected range, mainly where access control is configured in a way the flaw can exploit. Sites that do not use this plugin are not affected. unknown whether the sources name a specific required configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infomaniak","medium","other","vodinfomaniak","wordpress"],"campaign_type":null,"search_a":"'-121761':13A,16A '-2026':12A,15A 'access':9A 'author':6A 'check':7A 'control':10A 'cve':11A,14A 'expos':8A 'infomaniak':1A 'miss':5A 'plugin':4A 'vod':2A 'wordpress':3A","search_b":"'1.5.15':53B '4.3':59B 'access':33B 'affect':47B 'author':30B 'check':31B 'configur':40B 'control':34B 'cvss':58B 'exploit':38B 'flaw':46B 'includ':52B 'incorrect':41B 'infomaniak':17B,21B,25B 'medium':57B 'miss':28B 'plugin':26B 'rate':55B 'say':44B 'set':35B 'sourc':43B 'version':48B 'vod':20B,24B 'vod-infomaniak':19B 'wordpress':22B","search_c":"'1.5.15':86C 'access':75C 'affect':80C 'allow':71C 'author':61C 'configur':74C 'control':76C 'exploit':72C 'incorrect':73C 'infomaniak':64C,67C,70C,82C 'issu':79C 'levels.this':78C 'miss':60C 'n/a':84C 'network':65C 'secur':77C 'vod':66C,69C,81C 'vod-infomaniak':68C 'vulner':62C","first_public_at":"2026-11-07T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121761","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121761","severity":null,"published_at":"2026-11-07T09:17:13+00:00","modified_at":"2026-11-07T09:17:13+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","fetched_at":"2026-11-07T09:46:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}