CVE-2026-47696

Vulnerability

In WWBN AVideo 29.0 and earlier, the plugin/AuthorizeNet/processPayment.json.php endpoint is intended to process payments through the Authorize.Net payment gateway and credit the logged-in user's wallet. However, the endpoint contains a TODO comment indicating the real Authorize.Net charging logic was never implemented. Instead, the code reads the amount POST parameter from the attacker-controlled request, checks only that it is greater than zero, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance() to credit the user's wallet. No verification is performed of an Authorize.Net transaction ID, webhook signature, hosted payment token, nonce, server-side payment record, currency, or duplicate/replay state [1]. This vulnerability is exploitable when both the AuthorizeNet and YPTWallet plugins are enabled.

Exploitation

An attacker must be a logged-in user of the AVideo platform. The AuthorizeNet plugin must be enabled, and the YPTWallet plugin must be active. The attacker sends a POST request to plugin/AuthorizeNet/processPayment.json.php with a POST parameter amount set to a positive numeric value (e.g., 1000). The endpoint processes the request, bypasses any real payment, and adds the attacker-supplied amount to their wallet balance. No additional authentication, authorization, or validation is required beyond being logged in [1].

Impact

A successful attack allows any authenticated user to arbitrarily increase the balance of their own AVideo wallet without paying any actual funds. The attacker can then use this fake credit for any wallet-dependent features within the platform, causing direct financial loss to the site operator. The integrity of the wallet system is completely compromised, and there is no limit on the amount that can be added per request [1].

Mitigation

As of the advisory publication date, no patched version of AVideo has been released. The vendor has not confirmed a fix or published a workaround [1]. Until a patch is available, the only mitigation is to disable both the AuthorizeNet and YPTWallet plugins, or to remove the vulnerable endpoint. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog at the time of writing.