CVE-2026-3649 Missing authorization in Katalogportal-pdf-sync Widget
Authenticated users can access private PDF attachment details due to missing authorization checks in the plugin's AJAX handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3649?
CVE-2026-3649 is a medium-severity missing authorization vulnerability in colbeinformatik Katalogportal-pdf-sync Widget, published on 15 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0. The katalogportal_popup_shortcode() function is registered as an AJAX handler via wp_ajax_katalogportal_shortcodePrinter but lacks any capability check (current_user_can()) or nonce verification. This allows any authenticated user, including Subscribers, to call the endpoint and retrieve a list of all synchronized PDF attachments (including those attached to private or draft posts) along with their titles, actual filenames, and the katalogportal_userid configuration value. The WP_Query uses post_status => 'any' which returns attachments regardless of the parent post's visibility status.
Weakness: CWE-862
Which versions are affected by CVE-2026-3649?
How do I fix CVE-2026-3649?
No fix has been published for CVE-2026-3649 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-3649 being exploited?
There is no known exploitation of CVE-2026-3649 in the wild and no public exploit code.
Sources
Also known as GHSA-m65x-5prm-5wf2.