{"id":"CVE-2026-125445","kind":"vulnerability","aliases":["CVE-2026-125445"],"related":[],"title":"Infomaniak VOD WordPress plugin: CSRF lets attackers trigger unwanted actions","description":"Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.16.","summary":"The Infomaniak VOD plugin for WordPress has a cross-site request forgery flaw affecting versions through 1.5.16. An attacker can trick a logged-in administrator's browser into sending requests the plugin will accept.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vod-infomaniak","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","vod-infomaniak","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the VOD Infomaniak plugin in the WordPress admin plugin list, or in `wp-content/plugins/vod-infomaniak`.\n- Compare it against the fixed version: unknown if the sources do not say.","fix":"- Versions through `1.5.16` are affected; the fixed version is unknown from the sources.","status":"open","published_at":"2026-11-11T13:17:21+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","triaged_at":"2026-11-11T13:29:46+00:00","updated_at":"2026-11-11T13:29:46+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-11T13:29:46Z","model":"claude-haiku-5-5","output":{"fix":"- Versions through `1.5.16` are affected; the fixed version is unknown from the sources.","reach":"internet","title":"Infomaniak VOD WordPress plugin: CSRF lets attackers trigger unwanted actions","impact":"low","summary":"The Infomaniak VOD plugin for WordPress has a cross-site request forgery flaw affecting versions through 1.5.16. An attacker can trick a logged-in administrator's browser into sending requests the plugin will accept.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","vod-infomaniak"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Logged-in admin actions are performed without consent, altering plugin settings","analyst_note":"Confirm the fixed version and the affected actions from the NVD entry or the Infomaniak/WordPress plugin advisory.","how_to_check":"- Check the installed version of the VOD Infomaniak plugin in the WordPress admin plugin list, or in `wp-content/plugins/vod-infomaniak`.\n- Compare it against the fixed version: unknown if the sources do not say.","plain_action":"","product_name":"vod-infomaniak","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the VOD Infomaniak WordPress plugin at version 1.5.16 or earlier are in scope. Exposure depends on whether logged-in users with plugin privileges visit untrusted pages while signed in; sites without the plugin can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00076,"input_tokens":4561,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125445':13A,16A '-2026':12A,15A '1.5.16':42B,88C 'accept':60B 'action':10A 'administr':51B 'affect':39B,82C 'allow':76C 'attack':7A,44B 'browser':53B 'cross':34B,62C,77C 'cross-sit':33B,61C 'csrf':5A,66C 'cve':11A,14A 'flaw':38B 'forgeri':37B,65C 'forgery.this':80C 'infomaniak':1A,19A,23B,26B,69C,72C,75C,84C 'issu':81C 'let':6A 'log':49B 'logged-in':48B 'n/a':86C 'network':70C 'packag':20B 'plugin':4A,28B,58B 'request':36B,56B,64C,79C 'send':55B 'site':35B,63C,78C 'trick':46B 'trigger':8A 'unwant':9A 'version':40B 'vod':2A,18A,22B,27B,71C,74C,83C 'vod-infomaniak':17A,21B,73C 'vulner':67C 'wordpress':3A,24B,30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the VOD Infomaniak WordPress plugin at version 1.5.16 or earlier are in scope. Exposure depends on whether logged-in users with plugin privileges visit untrusted pages while signed in; sites without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["vodinfomaniak"],"ptokens":["infomaniak","vod"],"labels":["medium","package","vendor","vodinfomaniak","wordpress"],"campaign_type":null,"search_a":"'-125445':13A,16A '-2026':12A,15A 'action':10A 'attack':7A 'csrf':5A 'cve':11A,14A 'infomaniak':1A,19A 'let':6A 'plugin':4A 'trigger':8A 'unwant':9A 'vod':2A,18A 'vod-infomaniak':17A 'wordpress':3A","search_b":"'1.5.16':42B 'accept':60B 'administr':51B 'affect':39B 'attack':44B 'browser':53B 'cross':34B 'cross-sit':33B 'flaw':38B 'forgeri':37B 'infomaniak':23B,26B 'log':49B 'logged-in':48B 'packag':20B 'plugin':28B,58B 'request':36B,56B 'send':55B 'site':35B 'trick':46B 'version':40B 'vod':22B,27B 'vod-infomaniak':21B 'wordpress':24B,30B","search_c":"'1.5.16':88C 'affect':82C 'allow':76C 'cross':62C,77C 'cross-sit':61C 'csrf':66C 'forgeri':65C 'forgery.this':80C 'infomaniak':69C,72C,75C,84C 'issu':81C 'n/a':86C 'network':70C 'request':64C,79C 'site':63C,78C 'vod':71C,74C,83C 'vod-infomaniak':73C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125445","severity":null,"published_at":"2026-11-11T13:17:21+00:00","modified_at":"2026-11-11T13:17:21+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","fetched_at":"2026-11-11T13:27:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}