What is the CVSS score of EUVD-2026-22861?

EUVD-2026-22861 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress EUVD-2026-22861

| CVE-2026-3649 MEDIUM

Missing Authorization (CWE-862)

2026-04-15 Wordfence

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 09:09 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 09:00 euvd

EUVD-2026-22861

Analysis Generated

Apr 15, 2026 - 09:00 vuln.today

CVE Published

Apr 15, 2026 - 08:28 nvd

MEDIUM 5.3

DescriptionCVE.org

The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0. The katalogportal_popup_shortcode() function is registered as an AJAX handler via wp_ajax_katalogportal_shortcodePrinter but lacks any capability check (current_user_can()) or nonce verification. This allows any authenticated user, including Subscribers, to call the endpoint and retrieve a list of all synchronized PDF attachments (including those attached to private or draft posts) along with their titles, actual filenames, and the katalogportal_userid configuration value. The WP_Query uses post_status => 'any' which returns attachments regardless of the parent post's visibility status.

AnalysisAI

Unauthenticated attackers can retrieve sensitive PDF metadata and configuration values through a missing authorization flaw in the Katalogportal PDF Sync WordPress plugin (versions up to 1.0.0). The katalogportal_popup_shortcode() AJAX handler lacks capability checks and nonce verification, allowing any user to enumerate all synchronized PDF attachments-including those from private or draft posts-along with filenames and the katalogportal_userid configuration. This information disclosure has a CVSS score of 5.3 (low-to-medium severity) but enables reconnaissance for further attacks against WordPress installations.

Technical ContextAI

The Katalogportal PDF Sync plugin registers an AJAX action (wp_ajax_katalogportal_shortcodePrinter) that invokes the katalogportal_popup_shortcode() function without implementing WordPress's standard security controls: current_user_can() capability checks or wp_verify_nonce() token validation. The vulnerable function executes a WP_Query with post_status => 'any', bypassing WordPress's default post visibility filtering; this retrieves PDF attachments regardless of whether their parent posts are published, draft, or private. The exposed data includes attachment titles, actual filenames on the server, and the katalogportal_userid configuration parameter-all sensitive metadata that aids in further reconnaissance. CWE-862 (Missing Authorization) indicates the root cause is improper access control on a privileged function. The CPE cpe:2.3:a:colbeinformatik:katalogportal-pdf-sync_widget:*:*:*:*:*:*:*:* identifies the affected plugin across all versions up to and including 1.0.0.

RemediationAI

Users of the Katalogportal PDF Sync plugin should immediately update to a patched version if available from the plugin author or WordPress Plugin Directory; at time of analysis, no vendor-released patch version number is confirmed in the provided data. As an interim workaround, site administrators can restrict user registration (Settings > General > Membership) to prevent account creation, enforce role-based access controls to limit subscriber accounts, or temporarily deactivate the plugin until a security update is issued. Security.wordpress.org and the plugin's official support channels should be monitored for patch releases. For detailed vulnerability information and vendor guidance, refer to the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/a01e7b21-f3ff-42a8-b78a-ad69973eda01.