CVE-2026-126543

EUVD-2026-123068
WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen users_id to add wallet balance each billing cycle.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 14.75%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
wwbnavideo
𝑥
≤ 29.7.1
CNA
Common Weakness Enumeration
References
https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/PayPalYPT/ipnV2.php#L87-L125
https://github.com/WWBN/AVideo/commit/98406b7944e035e72082665ac886d78fc3af0a7f
https://github.com/WWBN/AVideo/security/advisories/GHSA-5gg3-9jhh-xf86
https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-wallet-credit-manipulation-via-paypalypt-ipnv2-php