GHSA-5gg3-9jhh-xf86: WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php

Published Nov 11, 2026

Updated

WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen usersid to add wallet balance each billing cycle.

Event History

Nov 11, 2026

CVE Published

via OSV·12:58 AM

Data Sourced

via OSV·12:58 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites running WWBN AVideo version 29.7.1 or earlier are affected if they use the PayPalYPT plugin endpoint at plugin/PayPalYPT/ipnV2.php. The vulnerable payment handling can credit user wallets based on IPNs that are not tied to the site's own PayPal merchant account.

What does an attacker need to exploit it?

An attacker does not need authentication. They need a genuine PayPal VERIFIED recurring-payment IPN from a PayPal account they control and must choose the users_id to be credited.

How is the wallet balance increased?

The attacker can forward the verified recurring-payment IPN to the vulnerable endpoint. Because the IPN is not validated as belonging to the site's merchant account, the selected user's wallet can be credited on each billing cycle.

GHSA-5gg3-9jhh-xf86: WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How is the wallet balance increased?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How is the wallet balance increased?