WWBN AVideo: Improper payment verification in PayPalYPT plugin (CVE-2026-126543)
WWBN AVideo versions up to 29.7.1 contain an improper payment verification vulnerability in the PayPalYPT plugin, allowing unauthenticated attackers to manipulate user wallet balances.
CVE search metadata
CVE search record: CVE-2026-126543. Severity: high. CVSS: 7.5. KEV: no. Product: AVideo (<= 29.7.1). Brief: WWBN AVideo: Improper payment verification in PayPalYPT plugin (CVE-2026-126543). Brief link: https://feed.craftedsignal.io/briefs/2026-11-wwbn-avideo-payment-bypass-cve-2026-126543/
Triage facts
Revision 1- Applicability
- AVideo (<= 29.7.1)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability within the 'plugin/PayPalYPT/ipnV2.php' script. The vulnerability allows unauthenticated attackers to supply a chosen 'users_id' alongside a genuine 'VERIFIED' payment notification from an attacker-controlled PayPal account. The application fails to validate that the transaction is bound to the site owner's merchant account, resulting in the unauthorized crediting of the specified user's wallet balance.
Impact
Successful exploitation allows unauthenticated attackers to artificially inflate wallet balances for arbitrary user accounts, potentially leading to financial loss or unauthorized access to paid content.
Recommendation
- Inventory all instances of WWBN AVideo currently running versions 29.7.1 or earlier.
- Implement an immediate block or restrict access to 'plugin/PayPalYPT/ipnV2.php' if the PayPal integration is not currently in use.
- Monitor web server logs for high volumes of POST requests to the PayPalYPT plugin endpoint, particularly those originating from non-PayPal infrastructure.
Threat Hunt
Identify abnormal POST requests to the ipnV2.php plugin script, specifically looking for repetitive patterns or high-frequency requests from single source IPs that do not match PayPal IPN source ranges.
Data: Web server access logs (cs-uri-stem, cs-method, c-ip)
Mitigations
Disable the PayPalYPT plugin if not required, or implement strict source IP filtering on the ipnV2.php endpoint to only allow communication from legitimate PayPal IP ranges.
CVE-2026-126543