Authorization Bypass in Infomaniak VOD Plugin for WordPress

CVE-2026-115831

What is CVE-2026-115831?

The Infomaniak VOD plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 1.5.15. This flaw arises from the plugin's failure to adequately verify user permissions, allowing authenticated attackers with minimal access (subscriber-level) to perform restricted actions. Specifically, these attackers can exploit the vulnerability to initiate unauthorized video imports using the site owner’s Infomaniak API credentials, which may result in consuming the VOD account's quota. Furthermore, they can insert arbitrary entries into the wp_vod_upload table, leading to the potential for public shortcodes to resolve to maliciously chosen video content. This behavior undermines the intended role-rights system of the plugin, which is designed to reserve such actions for users with Contributor-level access or above.

References