PT-2026-30333 · WordPress+1 · Blockonomicsypt+1

Adrgs · Published 2026-04-04 · Updated 2026-04-06 · CVE-2026-35448

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior

Description The BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin address without authentication. The endpoint was intended as an AJAX polling helper for the authenticated invoice.php page but lacks its own access control checks. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform. The response includes user ID of the buyer, total payment value, currency, BTC amounts (expected and received), transaction ID, and payment status. The BlockonomicsYPT plugin is deprecated but remains functional in current installations.

Recommendations Add an authentication check at plugin/BlockonomicsYPT/check.php:17: if (!User::isLogged()) { echo json encode(["error" => "Login required"]); exit; }

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-35448

GHSA-3V7M-QG4X-58H9

Affected Products

Avideo

Blockonomicsypt

References · 5

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9 · Exploit
• https://osv.dev/vulnerability/GHSA-3v7m-qg4x-58h9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35448 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/CVEnew/status/2041282865758167332 · Twitter Post