PT-2026-33021 · Colbeinformatik · Katalogportal-Pdf-Sync Widget

Phong Nguyen · Publicado 2026-04-15 · Atualizado 2026-04-24 · CVE-2026-3649

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0. The katalogportal popup shortcode() function is registered as an AJAX handler via wp ajax katalogportal shortcodePrinter but lacks any capability check (current user can()) or nonce verification. This allows any authenticated user, including Subscribers, to call the endpoint and retrieve a list of all synchronized PDF attachments (including those attached to private or draft posts) along with their titles, actual filenames, and the katalogportal userid configuration value. The WP Query uses post status => 'any' which returns attachments regardless of the parent post's visibility status.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-3649

Produtos afetados

Katalogportal-Pdf-Sync Widget

Referências · 7

• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/trunk/inc/class.admin.php#L209 · Nota
• https://reddit.com/r/StopBadBots/comments/1su8tkw/unpatched_threat_why_you_must_remove_these_29 · Publicação no Reddit
• https://wordfence.com/threat-intel/vulnerabilities/id/a01e7b21-f3ff-42a8-b78a-ad69973eda01?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/tags/1.0.0/inc/class.admin.php#L12 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3649 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/trunk/inc/class.admin.php#L12 · Nota
• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/tags/1.0.0/inc/class.admin.php#L209 · Nota