CVE-2026-126543: WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php
WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen usersid to add wallet balance each billing cycle.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
WWBN AVideo installations through version 29.7.1 are affected where the PayPalYPT plugin processes PayPal IPNs through ipnV2.php. The issue applies to wallet crediting for recurring payments.
What does an attacker need to exploit this?
An attacker does not need authentication. They need a genuine VERIFIED recurring-payment IPN from their own PayPal account and must supply a chosen users_id when forwarding it to the affected endpoint.
Is a forged PayPal notification required?
No. The vulnerability involves forwarding genuine VERIFIED PayPal recurring-payment IPNs that are not bound to the site's merchant account.
What is the impact of successful exploitation?
An attacker can add wallet balance to a chosen user account on each billing cycle associated with the forwarded recurring-payment IPN. The reported impact is integrity-related wallet credit manipulation.