https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 05:20:02 +0000 https://db.gcve.eu/vuln/cve-2026-115831 <p><strong>Affected:</strong> infomaniak-dev VOD Infomaniak</p> <p>The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to initiate unauthorized video imports using the site owner&#39;s Infomaniak API credentials, consume the site owner&#39;s VOD account quota, and insert arbitrary rows into the wp_vod_upload table causing public shortcodes to resolve to attacker-chosen video content. This action is explicitly reserved for Contributor-level and above by the plugin&#39;s own role-rights system, meaning subscriber access is intentionally forbidden by design — the AJAX handler simply omits the enforcement.</p> <p><strong>Affected:</strong> infomaniak-dev VOD Infomaniak</p> <p>The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to initiate unauthorized video imports using the site owner&#39;s Infomaniak API credentials, consume the site owner&#39;s VOD account quota, and insert arbitrary rows into the wp_vod_upload table causing public shortcodes to resolve to attacker-chosen video content. This action is explicitly reserved for Contributor-level and above by the plugin&#39;s own role-rights system, meaning subscriber access is intentionally forbidden by design — the AJAX handler simply omits the enforcement.</p> https://db.gcve.eu/vuln/cve-2026-115831