PT-2026-29359 · Unknown+1 · Wp Login Control+1

Adrgs · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34613

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior

Description The AVideo platform, in versions 26.0 and prior, has an issue in the objects/pluginSwitch.json.php endpoint. This endpoint allows administrators to enable or disable plugins but lacks CSRF token validation. The plugins database table is excluded from security checks, bypassing Referer/Origin domain validation during saves. With SameSite=None set on session cookies, an attacker can disable security plugins like LoginControl for two-factor authentication, subscription enforcement, or access control by tricking an administrator into visiting a malicious page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-34613

GHSA-HQXF-MHFW-RC44

Affected Products

Avideo

Wp Login Control

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34613.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-hqxf-mhfw-rc44 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34613 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34613 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hqxf-mhfw-rc44 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/da375103d59118d1c1b1801ac7fce3cd426f8736 · Note
• https://github.com/WWBN/AVideo/commit/7ddfe4ec270d720e11f5dc28db73dfcd2cf9192a · Note
• https://twitter.com/CVEnew/status/2039372123592876378 · Twitter Post