CVE-2026-3649

Name of the Vulnerable Software and Affected Versions Katalogportal PDF Sync versions prior to 1.0.1

Description The plugin contains a missing authorization flaw where the katalogportal popup shortcode() function, registered as an AJAX handler via wp ajax katalogportal shortcodePrinter, does not implement capability checks or nonce verification. This allows any authenticated user, such as those with Subscriber roles, to access the endpoint and retrieve a list of all synchronized PDF attachments, including those linked to private or draft posts. The leaked information includes attachment titles, actual filenames, and the katalogportal userid configuration value. This occurs because the WP Query uses the post status parameter set to any, which ignores the visibility status of the parent post.

Recommendations Update the plugin to a version later than 1.0.0. As a temporary mitigation, restrict access to the wp ajax katalogportal shortcodePrinter AJAX handler.