CVE-2026-126543

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 29.7.2

Description An improper payment verification issue exists in the plugin/PayPalYPT/ipnV2.php file. Unauthenticated attackers can manipulate the system by forwarding genuine VERIFIED recurring-payment Instant Payment Notifications (IPNs) from their own PayPal accounts. By specifying a chosen users id, attackers can credit wallet balances during each billing cycle using IPNs that are not bound to the site merchant account.

Recommendations Update to version 29.7.2 or later. As a temporary mitigation, restrict access to the plugin/PayPalYPT/ipnV2.php file.