# CVE-2026-126543: WWBN AVideo improper payment verification in PayPal IPN handler

Source: https://junglewise.ai/threats/cve-2026-126543-wwbn-avideo-through-29-7-1-contains-an-improper-payment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126543 · Severity: high · CVSS 7.5 · Published 2026-11-11

WWBN AVideo is a video hosting and streaming platform that accepts payments through PayPal. An unauthenticated attacker can exploit a flawed payment verification mechanism in the PayPal IPN handler to forge wallet credit notifications, allowing them to add arbitrary funds to any user's account on the platform without paying.

Technologies: [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-126543 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126543 being exploited in the wild.

**How severe is CVE-2026-126543?** High severity, with a CVSS score of 7.5, published 11 November 2026.

**Which products and versions are affected?** WWBN AVideo through 29.7.1.

**Is there a fix for CVE-2026-126543?** Yes: fixed in Version after 29.7.1 (commit 98406b7944e035e72082665ac886d78fc3af0a7f or later). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126543 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126543?** Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Version after 29.7.1 (commit 98406b7944e035e72082665ac886d78fc3af0a7f or later)

## Technical details

The PayPal IPN handler in plugin/PayPalYPT/ipnV2.php fails to verify that incoming IPN messages are bound to the site's merchant account before crediting wallets. An unauthenticated attacker can replay or forward genuine recurring-payment IPNs from their own PayPal account with a modified users_id parameter to credit another user's wallet on each billing cycle. The vulnerability requires network access to send HTTP POST/GET requests to the IPN endpoint but no authentication or user interaction.

## Affected products

- WWBN AVideo through 29.7.1

## Timeline

- 2026-11-11: disclosed
- 2026-11-09: patched: Commit 98406b7 refactors IPN handler to validate merchant account

## References

- [https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/PayPalYPT/ipnV2.php](https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/PayPalYPT/ipnV2.php)
- [https://github.com/WWBN/AVideo/commit/98406b7944e035e72082665ac886d78fc3af0a7f](https://github.com/WWBN/AVideo/commit/98406b7944e035e72082665ac886d78fc3af0a7f)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)