The vulnerability resides in the BulkEmbed plugin’s save endpoint, which retrieves thumbnail images from user‑supplied URLs through a raw HTTP request function. This path lacks SSRF checks that are present in other similar endpoints. An attacker that is logged into the system can supply an internal or private network address; the server will fetch the content at that address and return it as part of the thumbnail view, providing the attacker with access to otherwise restricted internal resources. The weakness is a classic Server‑Side Request Forgery, classified as CWE‑918, and does not provide remote code execution but exposes sensitive internal data.

Affecting the WWBN AVideo open‑source video platform, specifically all releases prior to version 26.0. The vulnerable code exists in the BulkEmbed plugin accessed via plugin/BulkEmbed/save.json.php. Applications running these versions that have the BulkEmbed feature enabled and logged‑in user accounts are susceptible. Version 26.0 contains a fix that hardens the URL fetch call.

The CVSS score of 5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of automated exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires legitimate authentication, but user‑level accounts are sufficient to trigger the fetch. Once triggered, the attacker can read any internal resource reachable from the server, potentially exposing internal services, configuration data, or sensitive content. The attack vector is an authenticated web application request, so defenders should prioritize fixing the missing SSRF protection.