WWBN/AVIDEO · CVE-2026-126543 · Other
NO FIX YET · SEE WHAT TO DO
AVideo's PayPal IPN handler in plugin/PayPalYPT/ipnV2.php credits wallet balances from PayPal notices that are not checked against the site's own merchant account. An unauthenticated attacker can forward a genuine recurring-payment notice from their own PayPal account with a chosen user ID and add wallet balance each billing cycle.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
AVideo sites (WWBN/AVideo, Composer) at 29.7.1 or earlier that run the PayPalYPT and YPTWallet plugins with live PayPal payments. No AVideo account is needed to attack; the attacker forwards a genuine PayPal recurring-payment notice from their own merchant account with a chosen users_id. Sites without PayPalYPT enabled, or only in sandbox mode, can skip it.
Not affected if no-paypal-plugin, no-paypal-wallet, paypal-sandbox-only, plugin-disabled
Who cares avideo, payments, paypal, php, self-hosted
WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen users_id to add wallet balance each billing cycle.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.