CVE-2026-115831 infomaniak-dev CVE debrief

Who should care

WordPress site administrators and security teams should assess exposure and apply patches or mitigations to prevent exploitation of this vulnerability. They should also monitor for suspicious activity related to video imports and VOD account quota consumption, and consider implementing additional security measures such as role-based access control and API credential management.

Why it matters

The VOD Infomaniak plugin for WordPress has an authorization bypass vulnerability that allows authenticated attackers to perform unauthorized actions, potentially leading to quota consumption and content manipulation. WordPress site administrators and security teams should assess exposure and apply patches or mitigations.

• Potential unauthorized video imports and VOD account quota consumption.
• Insertion of arbitrary rows into the wp_vod_upload table.
• Public shortcodes resolving to attacker-chosen video content.

Technical summary

The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass due to improper verification of user authorization. This allows authenticated attackers with subscriber-level access and above to perform unauthorized actions, potentially leading to quota consumption and content manipulation. The vulnerability is explicitly reserved for Contributor-level and above by the plugin's own role-rights system, meaning subscriber access is intentionally forbidden by design — the AJAX handler simply omits the enforcement.

Defensive priority

Medium priority for WordPress site administrators and security teams to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure by checking if the VOD Infomaniak plugin is installed and if the version is 1.5.15 or earlier.
• Verify that the plugin has been updated to a patched version, if available.
• Monitor for suspicious activity related to video imports and VOD account quota consumption.
• Consider implementing additional security measures, such as role-based access control and API credential management.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was reported by [email protected] and is documented in the CVE Program record and NVD vulnerability detail pages. The reporter provided details on the authorization bypass vulnerability, which allows authenticated attackers with subscriber-level access and above to perform unauthorized actions. The vulnerability is due to improper verification of user authorization by the VOD Infomaniak plugin. This could lead to potential quota consumption and content manipulation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.