Quick answers
- Is CVE-2026-126804 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-126804 being exploited in the wild.
- How severe is CVE-2026-126804?
- High severity, with a CVSS score of 8.1, published 11 November 2026.
- Which products and versions are affected?
- WWBN AVideo 12.4 through 29.7.1.
- Is there a fix for CVE-2026-126804?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-126804 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-126804?
- Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The deleteImage.json.php endpoint in the ADs plugin fails to properly validate the is_regular_user parameter, allowing an authenticated attacker to manipulate it with directory traversal sequences (../) or substitute other user IDs to access files outside the intended ads directory. The vulnerability requires authentication and custom ads permission, but allows deletion of critical files like videos/configuration.php via an unvalidated path passed to the getAdsPath() function.
Affected products
- WWBN AVideo 12.4 through 29.7.1
Timeline
- 2026-11-11: disclosed