VOD Infomaniak WordPress plugin: Cross-Site Request Forgery (CSRF)
Summary
The WordPress plugin VOD Infomaniak, which connects WordPress sites to Infomaniak's video-on-demand service, is affected by a Cross-Site Request Forgery (CSRF) vulnerability in versions through 1.5.16. An attacker can craft a malicious web page that makes a logged-in user perform unintended actions on the site, which can change data (integrity impact only). Exploitation requires that a logged-in user is tricked into visiting the attacker's page.
Affected
- VOD Infomaniak WordPress plugin, all versions through 1.5.16
Fixed in
- Version 1.5.17 or later
Workaround
- No vendor workaround documented.
- Until the update is installed, deactivate the plugin if it is not needed.
- Keep WordPress administrators and editors from browsing untrusted websites while logged in.
Exploitation
- Not known to be exploited.
- VulDB reports no available exploit; no exploit code found in Metasploit or Exploit-DB.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Identify all WordPress sites with the VOD Infomaniak plugin.
- Update the plugin to version 1.5.17 or later and verify the installed version.
- Prioritise sites where editors or administrators browse the web while logged in.
- Recheck Patchstack and NVD once NVD has analysed the record.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WordPress VOD Infomaniak plugin <= 1.5.16 CSRF patchstack.com
- CVE Record CVE-2026-125445 www.cve.org
- VulDB CVE-2026-125445 vuldb.com
- OffSeq Radar: CVE-2026-125445 radar.offseq.com
- Patchstack: VOD Infomaniak plugin overview patchstack.com
- Patchstack advisory: VOD Infomaniak plugin <= 1.5.7 CSRF (2024) patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:25.
Original description (NVD)
Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.16.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.