CVE-2026-47696: WWBN AVideo insufficient verification in AuthorizeNet plugin

Executive brief

WWBN AVideo is an open-source video platform. A vulnerability in its Authorize.Net payment plugin allows any logged-in user to add unlimited funds to their internal digital wallet without actually making a payment. This could lead to significant financial loss for site owners as users could purchase premium content or subscriptions for free.

Technical details

The vulnerability exists in `plugin/AuthorizeNet/processPayment.json.php` where the application fails to verify payment authenticity. The code contains a 'TODO' for actual API implementation and instead hardcodes the `$paymentSuccess` variable to `true`. An attacker can send a POST request to this endpoint with an arbitrary `amount` parameter; the system then calls `YPTWallet::addBalance()` to credit the user's account without validating transaction IDs, webhook signatures, or server-side records. This requires the AuthorizeNet and YPTWallet plugins to be enabled and the attacker to have a valid user session.

Affected products

• WWBN AVideo <= 29.0

Timeline

• 2026-05-19: disclosed: Advisory published by reporter
• 2026-05-29: advisory: NVD publication date
• 2026-06-04: advisory: GitHub Advisory Database publication date

References

• https://api.github.com/users/proochicken
• https://github.com/proochicken
• https://api.github.com/users/proochicken/gists%7B/gist_id%7D
• https://api.github.com/users/proochicken/repos
• https://avatars.githubusercontent.com/u/190519836?v=4
• https://api.github.com/users/proochicken/events%7B/privacy%7D