---
id: "CVE-2026-126543"
page: "https://infrastack.ai/live/CVE-2026-126543"
kind: "vulnerability"
aliases: ["CVE-2026-126543"]
title: "WWBN AVideo: forged PayPal payment notices credit user wallets"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "wwbn/avideo", "fixed": [], "affected": "<= 29.7.1", "ecosystem": "composer"}]
ecosystems: []
tags: ["avideo", "other", "payments", "paypal", "php", "self-hosted"]
not_affected_if: ["no-paypal-plugin", "no-paypal-wallet", "paypal-sandbox-only", "plugin-disabled"]
published_at: "2026-11-11T01:17:15+00:00"
first_seen_at: "2026-11-11T01:24:34+00:00"
updated_at: "2026-11-11T01:26:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126543", "first_seen_at": "2026-11-11T01:24:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-11T01:26:14+00:00"}]
exploit_sources: []
---

# WWBN AVideo: forged PayPal payment notices credit user wallets

Link for people: https://infrastack.ai/live/CVE-2026-126543 (this .md is for agents)

AVideo's PayPal IPN handler in plugin/PayPalYPT/ipnV2.php credits wallet balances from PayPal notices that are not checked against the site's own merchant account. An unauthenticated attacker can forward a genuine recurring-payment notice from their own PayPal account with a chosen user ID and add wallet balance each billing cycle.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:wwbn/avideo affected <= 29.7.1 fixed no fixed version listed

## How to check

- Check the AVideo version: 29.7.1 or earlier is affected.
- Check that the PayPalYPT and YPTWallet plugins are enabled with live PayPal payments (sandbox off); the attack needs this.
- Open plugin/PayPalYPT/ipnV2.php: if it never compares receiver_email/receiver_id to your merchant account and does not call findAgreementOwner, it is vulnerable.
- Review YPTWallet history for unexpected 'PayPal Subscription from token' credits.

## Fix

No patched release listed in the GitHub advisory (patched versions: none). Fix commit 98406b7 is on master; deploy from master at or after that commit, or disable the PayPalYPT plugin until a release ships.

## Timeline

- 2026-11-11T01:24:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126543
- 2026-11-11T01:26:14+00:00 analyst — Read GHSA-5gg3-9jhh-xf86: affected <=29.7.1, patched versions None; fix commit 98406b7 (2026-11-09) on master reworks ipnV2.php, no release tag with it seen. Exploit needs live PayPal + YPTWallet and PayPalYPT enabled; advisory has PoC (stubbed, in-advisory).

## Documents

- [advisory] Vendor advisory: github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-5gg3-9jhh-xf86
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-wallet-credit-manipulation-via-paypalypt-ipnv2-php
- [fix] Patch: github.com https://github.com/WWBN/AVideo/commit/98406b7944e035e72082665ac886d78fc3af0a7f

## From the sources

WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen users_id to add wallet balance each billing cycle.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_