WWBN AVideo, an open‑source video platform, was found to allow an authenticated administrator to execute arbitrary PHP code on the host. The flaw arose when the plugin import feature accepted a ZIP archive, extracted its contents directly into a publicly accessible plugin directory without validating file names or types. An attacker who can log in as an administrator could craft a ZIP containing PHP files, upload it, and then trigger the execution of those files, giving full control over the server.

The vulnerability affects all installations of WWBN AVideo running a version older than 24.0. Administrators with access to the plugin import functionality are the only ones able to exploit this flaw; the affected code resides in the community‑sourced "plugin" upload path. Version 24.0 and later contain the necessary fix for the issue.

The CVSS score of 9.3 marks this flaw as critical, and although the EPSS probability is listed as less than 1 percent, the risk is still high because only an authenticated administrator is required. The vulnerability is not currently cataloged in the CISA KEV list, but the potential impact of code execution on a public platform warrants immediate attention. An attacker who successfully uploads the malicious ZIP can run arbitrary commands on the file system, read or delete data, and potentially pivot to other services.