CVE-2026-3649: 
WordPress vulnerability analysis and mitigation

CVE-2026-3649 is a Missing Authorization vulnerability in the Katalogportal PDF Sync plugin for WordPress, affecting all versions up to and including 1.0.0. The flaw allows any authenticated user — including low-privilege Subscribers — to access a list of all synchronized PDF attachments, their filenames, and a plugin configuration value, even for private or draft posts. It was published to the National Vulnerability Database on April 15, 2026, and to the GitHub Advisory Database on April 22, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (GitHub Advisory, Wordfence).

The root cause is CWE-862 (Missing Authorization): the katalogportal_popup_shortcode() function is registered as a WordPress AJAX handler via the wp_ajax_katalogportal_shortcodePrinter hook but performs no capability check (current_user_can()) and no nonce verification before executing. The internal WP_Query is called with post_status => 'any', which returns PDF attachments regardless of the visibility status of their parent posts, bypassing WordPress's normal access controls. Any authenticated user can trigger this endpoint over the network with a simple HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php), requiring no elevated privileges or complex conditions (GitHub Advisory, Wordfence).

Successful exploitation results in unauthorized information disclosure: an attacker with any authenticated WordPress account can enumerate all synchronized PDF attachments, including those associated with private or draft posts that should not be publicly visible. Exposed data includes attachment titles, actual filenames on the server, and the katalogportal_userid configuration value, which could facilitate further targeted attacks or reconnaissance. There is no integrity or availability impact; the vulnerability is limited to confidentiality loss (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.032–0.045%, placing it in the 14th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Authenticate: Obtain any valid WordPress account on the target site, including a low-privilege Subscriber account (e.g., via self-registration if enabled).
2. Identify the AJAX endpoint: Locate the WordPress AJAX handler at /wp-admin/admin-ajax.php.
3. Craft the request: Send an HTTP POST request to the AJAX endpoint with the parameter action=katalogportal_shortcodePrinter and a valid WordPress authentication cookie or nonce (no capability check is enforced).
4. Retrieve sensitive data: Parse the JSON/HTML response, which will contain a list of all synchronized PDF attachments — including those attached to private or draft posts — along with their titles, filenames, and the katalogportal_userid configuration value.
5. Use disclosed information: Leverage the exposed filenames to directly access or download PDF files, or use the katalogportal_userid value for further reconnaissance against the Katalogportal service (GitHub Advisory, Wordfence).

• Network: Repeated or anomalous HTTP POST requests to /wp-admin/admin-ajax.php with the parameter action=katalogportal_shortcodePrinter from low-privilege user sessions or unexpected IP addresses.
• Logs: WordPress access logs showing authenticated Subscriber-level accounts making requests to the AJAX endpoint outside of normal usage patterns; multiple rapid requests to the same endpoint suggesting automated enumeration.
• Application: Unexpected access to PDF attachment URLs (especially those linked to private or draft posts) originating from low-privilege user accounts shortly after AJAX endpoint calls.

Update the Katalogportal PDF Sync plugin to the latest patched version (beyond 1.0.0) as soon as it becomes available; a patch has been released to address the missing authorization controls (GitHub Advisory). As an interim measure, restrict Subscriber-level registration on the WordPress site if not required, and review user roles to minimize the number of authenticated accounts. Audit WordPress access logs for suspicious calls to the katalogportal_shortcodePrinter AJAX action. Consider using a WordPress security plugin (e.g., Wordfence) to monitor and block unauthorized AJAX endpoint access (Wordfence).