WWBN AVideo versions prior to 24.0 permit attackers to forge requests against legacy endpoints such as playlistStatus.php. The vulnerability bypasses the default JSON‑only CSRF guard, enabling an authenticated user to unknowingly alter playlist privacy, delete playlist items, or submit video suggestions. The effect is a change in the integrity and visibility of user‑generated content, potentially exposing private playlists or corrupting content management.

The issue affects all installations of WWBN AVideo released before version 24.0. Versions lacking the CSRF guard on legacy endpoints are vulnerable regardless of the operating system or web server configuration.

With a CVSS score of 5.1 the flaw carries a medium severity rating. The EPSS score of less than 1% indicates a very low likelihood of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers would require the victim to load a crafted page that auto‑submits a form to a legacy endpoint. Because the flaw allows action only while the victim is authenticated, the exploitation window is narrow and requires social engineering to lure users to the malicious page.