The vulnerability is a CSRF flaw in the AVideo pluginSwitch.json.php endpoint, which allows an authenticated administrator to enable or disable any installed plugin without authentication beyond the admin session and without a CSRF token. An attacker can lure an admin to a malicious webpage that automatically performs the request because session cookies have SameSite=None, thereby turning off essential security measures such as two‑factor authentication, subscription enforcement, or access controls. The flaw enables the removal of security safeguards and could lead to system compromise or data exfiltration if a malicious admin user disables protective plugins.

The affected product is WWBN AVideo, versions 26.0 and any earlier releases. No specific patch or version remedy is currently available from the vendor.

The CVSS score of 6.5 reflects the significant impact on security controls. EPSS indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread publicly known exploits exist. The likely attack vector requires social engineering to convince a legitimate administrator to visit a malicious page, after which the CSRF request automatically disables the target plugin. Even with low exploitation probability, the loss of critical security functionality represents a high‑risk scenario for any installation with active security plugins.