The vulnerability in the AVideo platform allows an attacker to change the player skin configuration via a CSRF attack. The admin/playerUpdate.json.php endpoint lacks CSRF validation and the ORM security check is suppressed for the plugins table, while cookies use SameSite=None. This enables a malicious cross-origin POST to alter the appearance of the video player for all platform users.

Systems affected are all installations of WWBN AVideo version 26.0 or earlier. Administrators can unintentionally expose the platform to defacement through the compromised endpoint.

With a CVSS score of 4.3 the risk is moderate. The absence of an EPSS score and lack of presence in KEV suggest limited evidence of active exploitation, though the attack path is straightforward and requires only a victim admin on the same origin. Operators should prefer a patch over a work‑around.