Description

The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to initiate unauthorized video imports using the site owner's Infomaniak API credentials, consume the site owner's VOD account quota, and insert arbitrary rows into the wp_vod_upload table causing public shortcodes to resolve to attacker-chosen video content. This action is explicitly reserved for Contributor-level and above by the plugin's own role-rights system, meaning subscriber access is intentionally forbidden by design — the AJAX handler simply omits the enforcement.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-11-06T10:16:36.123Z",
  "pubdate": "2026-11-06T10:16:36.123Z",
  "executiveSummary": "The VOD Infomaniak plugin for WordPress, in versions up to and including 1.5.15, contains a critical authorization bypass vulnerability. This security flaw stems from a failure to perform adequate capability checks within the plugin's AJAX request handlers.\nThe vulnerability allows authenticated users with subscriber-level permissions—or higher—to execute sensitive functions intended exclusively for users with Contributor-level access or greater. By bypassing these intended access controls, an attacker can invoke backend routines responsible for video ingestion using the site administrator's pre-configured Infomaniak API credentials.\nThe primary risk implications include unauthorized consumption of the site owner's VOD account quota and the potential for content manipulation. An attacker can force the application to insert arbitrary database records into the 'wp_vod_upload' table. Consequently, public-facing shortcodes can be manipulated to resolve to attacker-controlled video content, leading to unauthorized asset display or service abuse. This vulnerability highlights a significant failure in the principle of least privilege, as the plugin developers explicitly intended for these actions to be restricted to specific roles, yet omitted the requisite security enforcement at the implementation level.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of authorization checks within the plugin's AJAX endpoint handler. In WordPress plugin development, AJAX actions are registered and invoked via the 'admin-ajax.php' script. The vulnerable component fails to validate the current user's capabilities against the required security level before executing the backend logic associated with video management.\nSpecifically, the plugin logic intended to restrict administrative actions to users with 'Contributor' privileges or higher is non-existent within the specific AJAX callback function. Because the function lacks a check for 'current_user_can()', any authenticated session—including those with the lowest-privilege 'Subscriber' role—can trigger the underlying routines.\nThe attack flow follows a predictable pattern: 1) An attacker authenticates to the WordPress instance with at least Subscriber-level credentials. 2) The attacker crafts an HTTP POST request targeting 'admin-ajax.php', specifying the action associated with the VOD import routine. 3) The server-side code receives the request and, lacking a check for required capabilities, processes the payload. 4) The plugin utilizes the server's stored Infomaniak API keys to communicate with external Infomaniak infrastructure, effectively performing actions on behalf of the site administrator.\nBeyond unauthorized API usage, the attack leads to direct database manipulation. The payload allows for the injection of entries into the 'wp_vod_upload' table. This table is used by the plugin to associate metadata and identifiers with video content rendered via shortcodes. By inserting arbitrary rows, an attacker can modify the mapping of existing or new shortcodes to point toward external video assets or malicious files hosted on the Infomaniak platform. This allows for unauthorized content injection into the victim's website, potentially misleading users or compromising the site's integrity.\nThe vulnerability is present in versions up to and including 1.5.15. It requires valid user authentication, meaning it is not directly exploitable by unauthenticated visitors; however, the low barrier to entry (Subscriber role) combined with the ability to leverage stored API credentials makes this a high-impact security oversight."
}