{"id":"CVE-2026-115831","title":"VOD Infomaniak <= 1.5.15 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Video Importation via vodimportvideo AJAX Action","summary":"The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it po…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"infomaniak-dev","product":"VOD Infomaniak","affected":["vod_infomaniak <= 1.5.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T17:33:32.524050Z"},"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:33:43.671Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115831","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1c79256-3f59-4137-b81b-e2bb5402c148?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/vod-infomaniak/tags/1.5.15/vod.class.php#L388"},{"url":"https://plugins.trac.wordpress.org/browser/vod-infomaniak/tags/1.5.15/vod.class.php#L92"},{"url":"https://plugins.trac.wordpress.org/browser/vod-infomaniak/tags/1.5.15/vod.class.php#L1790"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3781274%40vod-infomaniak&new=3781274%40vod-infomaniak"}],"tags":["cve.org"],"epss":0.00366,"epssPercentile":0.30565,"ingestedAt":"2026-11-06T09:48:47.390Z","slug":"CVE-2026-115831","body":"## Overview\n\nThe VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to initiate unauthorized video imports using the site owner's Infomaniak API credentials, consume the site owner's VOD account quota, and insert arbitrary rows into the wp_vod_upload table causing public shortcodes to resolve to attacker-chosen video content. This action is explicitly reserved for Contributor-level and above by the plugin's own role-rights system, meaning subscriber access is intentionally forbidden by design — the AJAX handler simply omits the enforcement.\n\n## Affected\n\n- `vod_infomaniak <= 1.5.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}