Executive brief
WWBN AVideo is a popular video platform software that allows users to create and manage video channels. An unauthenticated attacker can forge changes to user subscriber counts by tricking a logged-in administrator into visiting a malicious webpage, damaging the integrity of user rankings and social proof metrics on affected channels. The vulnerability affects the default-enabled CustomizeUser plugin and remains unpatched as of the advisory date.
Technical details
A cross-site request forgery vulnerability exists in the CustomizeUser plugin's setSubscribers.json.php endpoint, which accepts users_id and ExtraSubscribers parameters from $_REQUEST without validating a CSRF token or requiring a POST method. The autoCSRFGuard() function only protects POST requests to *.json.php endpoints, and the mutation bypasses the ObjectYPT::save()/isUntrustedRequest() validation layer. An unauthenticated attacker can craft a simple GET request (e.g., via an image tag on an attacker-controlled website) that, when visited by a logged-in administrator, modifies the ExtraSubscribers count for any user. The attack requires user interaction (admin visits malicious page) but no authentication or privilege escalation; no patched version was available at the time of reporting.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23)
Timeline
- 2026-08-26: disclosed
- 2026-09-10: advisory