The Katalogportal PDF Sync plugin for WordPress, up to version 1.0.0, lacks proper authorization checks on its AJAX handler. Because the handler is registered without capability checks or nonce verification, any authenticated user—including subscribers—can invoke the endpoint. The endpoint returns a complete list of synchronized PDF attachments, including those attached to private or draft posts, along with their titles, filenames, and a configuration value. This exposes internal metadata and file names, constituting an information‑disclosure vulnerability identified as unauthorized access (CWE‑862).

WordPress sites running the Katalogportal PDF Sync plugin version 1.0.0 or earlier are affected. The plugin is distributed by colbeinformatik under the name Katalogportal PDF Sync Widget. No additional operating system or WordPress version constraints are listed.

The CVSS score of 5.3 indicates moderate severity. The flaw can be exploited by any authenticated WordPress user, a condition that can arise from legitimate access or credential compromise. Because the endpoint returns data from attachments associated with private or draft posts, the disclosed information may contain sensitive filenames and metadata. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, implying that current exploitation activity is uncertain.