WWBN AVideo 29.0 through 29.4.0 exploits a race condition in the PayPalYPT plugin’s ipn.php. The non‑atomic deduplication check allows two concurrent PayPal IPN messages that share the same recurring‑payment ID to both pass the isRecurringPaymentIdUsed() test, giving the attacker duplicate wallet credits and repeated subscription renewals. This CWE‑367 race condition results in unauthorized financial benefits for the attacker and revenue loss for the victim.

Vulnerable versions are WWBN AVideo 29.0 through 29.4.0. The issue is confined to the plugin/PayPalYPT/ipn.php component. No other products or later releases are listed as affected.

The CVSS score is 6.0, indicating a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a remote attacker replaying a captured PayPal IPN request to the vulnerable endpoint. Exploitation requires only the ability to send HTTP POST requests to ipn.php, so the attack surface is high for an external adversary with network access. While no active exploitation is documented, the financial impact and reliance on PayPal’s fraud controls make this a non‑negligible risk for deployed systems.