PT-2026-37299 · Wwbn+1 · Avideo+1

Offset · Published 2026-05-05 · Updated 2026-05-12 · CVE-2026-43883

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 29.1

Description An authorization gap exists in the PayPalYPT plugin where the endpoint 'plugin/PayPalYPT/agreementCancel.json.php' cancels a PayPal billing agreement using an attacker-supplied agreement parameter without verifying if the authenticated user owns the agreement. A low-privilege authenticated user who obtains another user's PayPal billing agreement ID can silently suspend the victim's recurring subscription. This leads to revenue loss for the platform and loss of paid service for the victim. The issue occurs because the server fails to verify that the logged-in user's ID matches the owner of the agreement before calling the cancelAgreement() function.

Recommendations Update to a version that includes commit 0da3dcff1eda2f497694bf82b559829471c292c2. As a temporary workaround, restrict access to the 'plugin/PayPalYPT/agreementCancel.json.php' endpoint or disable the PayPalYPT plugin until the update is applied.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-43883

GHSA-958H-QP3X-Q4GJ

Affected Products

Avideo

Paypalypt

References · 8

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-958h-qp3x-q4gj · Exploit
• https://osv.dev/vulnerability/GHSA-958h-qp3x-q4gj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43883 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/0da3dcff1eda2f497694bf82b559829471c292c2 · Note
• https://twitter.com/VulmonFeeds/status/2054015467811958965 · Twitter Post
• https://t.me/CVEtracker/53414 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1t5dfkb/resumen_diario_de_vulnerabilidades_06052026 · Reddit Post