EUVD-2026-22861Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0. The katalogportal_popup_shortcode() function is registered as an AJAX handler via wp_ajax_katalogportal_shortcodePrinter but lacks any capability check (current_user_can()) or nonce verification. This allows any authenticated user, including Subscribers, to call the endpoint and retrieve a list of all synchronized PDF attachments (including those attached to private or draft posts) along with their titles, actual filenames, and the katalogportal_userid configuration value. The WP_Query uses post_status => 'any' which returns attachments regardless of the parent post's visibility status.
AnalysisAI
Unauthenticated attackers can retrieve sensitive PDF metadata and configuration values through a missing authorization flaw in the Katalogportal PDF Sync WordPress plugin (versions up to 1.0.0). The katalogportal_popup_shortcode() AJAX handler lacks capability checks and nonce verification, allowing any user to enumerate all synchronized PDF attachments-including those from private or draft posts-along with filenames and the katalogportal_userid configuration. This information disclosure has a CVSS score of 5.3 (low-to-medium severity) but enables reconnaissance for further attacks against WordPress installations.
Technical ContextAI
The Katalogportal PDF Sync plugin registers an AJAX action (wp_ajax_katalogportal_shortcodePrinter) that invokes the katalogportal_popup_shortcode() function without implementing WordPress's standard security controls: current_user_can() capability checks or wp_verify_nonce() token validation. The vulnerable function executes a WP_Query with post_status => 'any', bypassing WordPress's default post visibility filtering; this retrieves PDF attachments regardless of whether their parent posts are published, draft, or private. The exposed data includes attachment titles, actual filenames on the server, and the katalogportal_userid configuration parameter-all sensitive metadata that aids in further reconnaissance. CWE-862 (Missing Authorization) indicates the root cause is improper access control on a privileged function. The CPE cpe:2.3:a:colbeinformatik:katalogportal-pdf-sync_widget:*:*:*:*:*:*:*:* identifies the affected plugin across all versions up to and including 1.0.0.
RemediationAI
Users of the Katalogportal PDF Sync plugin should immediately update to a patched version if available from the plugin author or WordPress Plugin Directory; at time of analysis, no vendor-released patch version number is confirmed in the provided data. As an interim workaround, site administrators can restrict user registration (Settings > General > Membership) to prevent account creation, enforce role-based access controls to limit subscriber accounts, or temporarily deactivate the plugin until a security update is issued. Security.wordpress.org and the plugin's official support channels should be monitored for patch releases. For detailed vulnerability information and vendor guidance, refer to the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/a01e7b21-f3ff-42a8-b78a-ad69973eda01.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today