A flawed CSRF validation in AVideo’s admin plugin configuration endpoint allows an attacker to forge cross‑origin POST requests that overwrite any plugin setting. By bypassing normal token checks and the table‑level security guard, the attacker gains ability to reconfigure payment processors, authentication providers, and cloud storage credentials, effectively taking control of the platform.

Every installation of WWBN AVideo running version 26.0 or earlier is affected, because the vulnerability resides in the admin/save.json.php endpoint and the application’s SameSite=None cookie policy.

The CVSS Base Score of 8.1 indicates high severity. The EPSS score of less than 1 % suggests limited current exploitation, and the issue is not in the CISA KEV catalog. The attack requires an attacker to host a malicious page that a logged‑in administrator visits while the session cookie is present. The forged request is then accepted without validation, giving the attacker full administrative capabilities. Until a vendor patch is released, the risk remains significant for any site that uses third‑party payment or storage services.