AVideo (<= 29.7.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/avideo--29.7.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:53:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWWBN AVideo: Improper payment verification in PayPalYPT plugin (CVE-2026-126543)https://feed.craftedsignal.io/briefs/2026-11-wwbn-avideo-payment-bypass-cve-2026-126543/Wed, 11 Nov 2026 13:53:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-wwbn-avideo-payment-bypass-cve-2026-126543/WWBN AVideo versions up to 29.7.1 contain an improper payment verification vulnerability in the PayPalYPT plugin, allowing unauthenticated attackers to manipulate user wallet balances.WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability within the 'plugin/PayPalYPT/ipnV2.php' script. The vulnerability allows unauthenticated attackers to supply a chosen 'users_id' alongside a genuine 'VERIFIED' payment notification from an attacker-controlled PayPal account. The application fails to validate that the transaction is bound to the site owner's merchant account, resulting in the unauthorized crediting of the specified user's wallet balance.

Impact

Successful exploitation allows unauthenticated attackers to artificially inflate wallet balances for arbitrary user accounts, potentially leading to financial loss or unauthorized access to paid content.

Recommendation

  1. Inventory all instances of WWBN AVideo currently running versions 29.7.1 or earlier.
  2. Implement an immediate block or restrict access to 'plugin/PayPalYPT/ipnV2.php' if the PayPal integration is not currently in use.
  3. Monitor web server logs for high volumes of POST requests to the PayPalYPT plugin endpoint, particularly those originating from non-PayPal infrastructure.
]]>highadvisory