In versions of the WWBN AVideo video platform up to and including 26.0, the Gallery plugin’s saveSort.json.php endpoint incorporates user‑supplied values from the sections parameter directly into a PHP eval() call without sanitization. Although the endpoint is accessible only to administrators, it lacks CSRF token validation and the platform’s SameSite=None session cookie configuration permits cross‑site request forgery. As a result, an attacker can trigger arbitrary PHP code execution on the server simply by getting an administrator to visit a malicious page.

The vulnerability affects the open‑source AVideo platform distributed by WWBN. All releases through version 26.0 are impacted; newer releases are not listed as affected.

The CVSS v3.1 score of 8.8 indicates high severity, and the EPSS score of under 1% suggests a low probability of exploitation in the wild, yet the presence of a fully remote code execution vector means an exploit would have catastrophic impact. Because the flaw can be triggered via CSRF against an admin session, any authenticated administrator who visits an attacker‑controlled page is at risk. The vulnerability is not currently listed in the CISA KEV catalog, but the lack of mitigation in the affected code base makes it a high‑priority target for attackers.