PT-2026-29364 · WordPress+1 · Stripeypt+1

Adrgs · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34737

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior

Description AVideo is an open source video platform. A debug endpoint, test.php, within the StripeYPT plugin is accessible to all logged-in users, not just administrators. This endpoint processes Stripe webhook-style payloads and triggers subscription operations, including cancellation. A flaw in the retrieveSubscriptions() method causes subscriptions to be cancelled instead of retrieved. This allows any authenticated user to cancel arbitrary Stripe subscriptions by providing a subscription ID.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-34737

GHSA-38RH-4V39-VFXV

Affected Products

Avideo

Stripeypt

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34737.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-38rh-4v39-vfxv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-38rh-4v39-vfxv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34737 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/8ac79b9375872f02f72999157b19a40c17126513 · Note
• https://twitter.com/cyberbivash/status/2039091961970274435 · Twitter Post
• https://twitter.com/CVEnew/status/2039372118001852473 · Twitter Post