In versions up to and including 26.0, the plugin import endpoint permits an administrator to upload and install plugin ZIP files. The application lacks CSRF protection while it explicitly sets session.cookie_samesite to 'None' for HTTPS connections. This design flaw allows an unauthenticated attacker to craft a page that, when visited by a legitimate admin, silently uploads a malicious plugin containing executable PHP code, resulting in remote code execution on the server. The weakness is a Cross‑Site Request Forgery flaw.

The vulnerability affects the open‑source video platform AVideo from WWBN. All installations running version 26.0 or earlier are susceptible; newer releases incorporate a patch that removes the CSRF vulnerability in the plugin import functionality.

The CVSS score of 8.8 denotes a high severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to lure an authenticated administrator to a malicious page that triggers the CSRF request; once the page is visited the compromise is immediate and gives full control over the server through the uploaded PHP webshell.