The Infomaniak Network VOD Infomaniak WordPress plugin suffers from a missing authorization check that allows an attacker to call protected endpoints without authenticating. This flaw permits the attacker to read or modify content, settings, or media management options that should be restricted to privileged users, thereby compromising the confidentiality and integrity of the site’s media operations.

WordPress sites that use the VOD Infomaniak plugin from its initial release up through version 1.5.15 are affected. The plugin is distributed by Infomaniak Network under the name VOD Infomaniak, and any installation of versions up to and including 1.5.15 remains vulnerable.

The CVSS base score of 4.3 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. Based on the description, it is inferred that an attacker can exploit the flaw from a remote location by sending HTTP requests to the plugin’s protected endpoints without needing to authenticate. Such a remote attack vector means that the vulnerability can be abused by anyone with internet access to the site, though no further credentials or internal network access is required.