WordPress Plugin Vulnerabilities

VOD Infomaniak < 1.5.10 - Missing Authorization

Description

The VOD Infomaniak plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importPostVideoDispo() and importPostVideoEnding() functions in versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to import videos.

Affects Plugins

Plugin icon
vod-infomaniak
Fixed in 1.5.10

References

CVE
CVE-2025-22729
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1a47b096-43c8-4fc4-9fe1-0afa311a420c

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Mika
Verified
No
WPVDB ID
ab03ba50-73d3-4ee7-8631-078c277f29a0

Timeline

Publicly Published
2025-01-14 (about 1 year ago)
Added
2025-01-21 (about 1 year ago)
Last Updated
2025-01-21 (about 1 year ago)

Other

Published
Title
Published
2024-07-05
Title
Spectra < 2.13.8 - Missing Authorization via generate_ai_content
Published
2025-12-15
Title
Image Caption Hover Pro < 20.0 - Missing Authorization
Published
2026-01-05
Title
Sugar Calendar (Lite) < 3.10.0 - Missing Authorization
Published
2024-05-23
Title
Schema App Structured Data < 2.2.1 - Missing Authorization
Published
2026-03-11
Title
Responsive Blocks – Page Builder for Blocks & Patterns < 2.2.1 - Missing Authorization