CVE-2026-125445: WordPress VOD Infomaniak plugin <= 1.5.16 - Cross Site Request Forgery (CSRF) vulnerability

Q: What must an attacker do to exploit this issue?

The attacker must cause a user to interact with a crafted request, as indicated by the required user interaction in the CVSS vector. No attacker privileges are required.

Q: What is the likely impact if exploitation succeeds?

The reported CVSS impact is limited to integrity, with no reported confidentiality or availability impact. The issue could allow unauthorized changes through a forged request made in the context of a user’s session.

Q: Which plugin versions are affected?

VOD Infomaniak versions through 1.5.16 are affected. The available data does not identify a fixed version.

Published Nov 11, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.16.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress VOD Infomaniak plugin to a version that resolves this vulnerability.
Fixed in 1.5.17

Event History

Nov 11, 2026

CVE Published

via MITRE·12:11 PM

Data Sourced

via MITRE·12:11 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must cause a user to interact with a crafted request, as indicated by the required user interaction in the CVSS vector. No attacker privileges are required.

What is the likely impact if exploitation succeeds?

The reported CVSS impact is limited to integrity, with no reported confidentiality or availability impact. The issue could allow unauthorized changes through a forged request made in the context of a user’s session.

Which plugin versions are affected?