PT-2026-33021 · Colbeinformatik · Katalogportal-Pdf-Sync Widget

Phong Nguyen · Published 2026-04-15 · Updated 2026-04-15 · CVE-2026-3649

NVD

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0. The katalogportal popup shortcode() function is registered as an AJAX handler via wp ajax katalogportal shortcodePrinter but lacks any capability check (current user can()) or nonce verification. This allows any authenticated user, including Subscribers, to call the endpoint and retrieve a list of all synchronized PDF attachments (including those attached to private or draft posts) along with their titles, actual filenames, and the katalogportal userid configuration value. The WP Query uses post status => 'any' which returns attachments regardless of the parent post's visibility status.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3649

Affected Products

Katalogportal-Pdf-Sync Widget

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-3649 · Security Note
• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/tags/1.0.0/inc/class.admin.php#L209 · Note
• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/trunk/inc/class.admin.php#L12 · Note
• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/tags/1.0.0/inc/class.admin.php#L12 · Note
• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/trunk/inc/class.admin.php#L209 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a01e7b21-f3ff-42a8-b78a-ad69973eda01?source=cve · Note