CVE-2026-123486 · Other
NO FIX YET
WWBN AVideo versions 29.0 through 29.4.0 have a race condition in the PayPal IPN handler (plugin/PayPalYPT/ipn.php) where the duplicate-payment check and the insert are not atomic. An attacker who captures a valid recurring-payment notification can replay it concurrently to receive duplicate wallet credits and subscription renewals.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running WWBN AVideo 29.0 through 29.4.0 with the PayPalYPT plugin handling recurring PayPal IPN notifications. Sites without that plugin or outside the version range are not indicated as affected. The sources do not state a fixed version.
Not affected if plugin-disabled, version-outside-range
Who cares avideo, paypal, php, video-platform
29.0 through 29.4.0.plugin/PayPalYPT/ipn.php and confirm whether the PayPalYPT plugin is enabled.No fix yet, per the sources.
WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.