Katalogportal Pdf Sync Widget
Monthly
Unauthenticated attackers can retrieve sensitive PDF metadata and configuration values through a missing authorization flaw in the Katalogportal PDF Sync WordPress plugin (versions up to 1.0.0). The katalogportal_popup_shortcode() AJAX handler lacks capability checks and nonce verification, allowing any user to enumerate all synchronized PDF attachments-including those from private or draft posts-along with filenames and the katalogportal_userid configuration. This information disclosure has a CVSS score of 5.3 (low-to-medium severity) but enables reconnaissance for further attacks against WordPress installations.
Unauthenticated attackers can retrieve sensitive PDF metadata and configuration values through a missing authorization flaw in the Katalogportal PDF Sync WordPress plugin (versions up to 1.0.0). The katalogportal_popup_shortcode() AJAX handler lacks capability checks and nonce verification, allowing any user to enumerate all synchronized PDF attachments-including those from private or draft posts-along with filenames and the katalogportal_userid configuration. This information disclosure has a CVSS score of 5.3 (low-to-medium severity) but enables reconnaissance for further attacks against WordPress installations.