The VOD Infomaniak plugin for WordPress contains a missing authorization check in the vodimportvideo AJAX handler. When a user with subscriber-level access (or higher) invokes the endpoint, the plugin does not verify the user’s role against the intended Contributor-level restriction. This flaw allows the attacker to initiate video imports using the site owner’s Infomaniak API keys, consume the owner’s video‑on‑demand quota, and add arbitrary rows to the wp_vod_upload database table. Those rows can then be referenced by public shortcodes, so the attacker can cause the site to display video content of their choosing, effectively hijacking the public video experience.

The vulnerability affects installations of the VOD Infomaniak plugin produced by infomaniak-dev for WordPress, specifically all versions up to and including 1.5.15. WordPress sites that have this plugin installed and support user roles such as Subscriber, Contributor, Author, Editor, or Administrator are subject to the flaw. The flaw is triggered by authenticated users who can send AJAX requests to the vodimportvideo action.

The CVSS v3 score is 4.3, indicating low threat severity in isolation. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. However, the attack vector requires an authenticated user; therefore, any site that allows subscriber or higher access to the WordPress admin area or AJAX calls can be targeted. An attacker with a legitimate login can simply issue the vodimportvideo request—either through the UI or by crafting a POST payload—to force the server to use the site owner’s credentials and perform the import, bypassing the intended role restriction.