CVE-2026-3649

The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0. The katalogportal_popup_shortcode() function is registered as an AJAX handler via wp_ajax_katalogportal_shortcodePrinter but lacks any capability check (current_user_can()) or nonce verification. This allows any authenticated user, including Subscribers, to call the endpoint and retrieve a list of all synchronized PDF attachments (including those attached to private or draft posts) along with their titles, actual filenames, and the katalogportal_userid configuration value. The WP_Query uses post_status => 'any' which returns attachments regardless of the parent post's visibility status.

• CWE-862

• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/tags/1.0.0/inc/class.admin.php#L12
• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/tags/1.0.0/inc/class.admin.php#L209
• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/trunk/inc/class.admin.php#L12
• https://plugins.trac.wordpress.org/browser/katalogportal-pdf-sync/trunk/inc/class.admin.php#L209
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a01e7b21-f3ff-42a8-b78a-ad69973eda01?source=cve

Published

Apr 15, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3644The fix for CVE-2026-0672, which rejected control characters…7.5
• CVE-2026-3645The Punnel – Landing Page Builder plugin for WordPress is vu…5.3
• CVE-2026-36458ChestnutCMS v1.5.10 has a SQL injection vulnerability. The c…9.8
• CVE-2026-3646The LTL Freight Quotes – R+L Carriers Edition plugin for Wor…5.3
• CVE-2026-36460Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerab…4.8
• CVE-2026-36478An issue in Technitium DNS Server v.14.3 and before allows a…7.5
• CVE-2026-36499A missing upper-bound check in the udpif_set_threads() funct…6.5
• CVE-2026-3650A memory leak exists in the Grassroots DICOM library (GDCM).…8.7
• CVE-2026-36500An issue in the cluster-admin:backup-datastore component of …9.1
• CVE-2026-36501An issue in the Externalizable.readExternal() component of C…7.5
• CVE-2026-3651The Build App Online plugin for WordPress is vulnerable to u…5.3
• CVE-2026-3652The ARForms plugin for WordPress is vulnerable to Stored Cro…7.2