The BlockonomicsYPT plugin’s check.php script returns payment order data for any Bitcoin address without performing authentication checks. The endpoint was intended only for internal AJAX use on a protected invoice page but lacks access control, allowing any requester to obtain transaction records tied to addresses listed on the platform. The weakened confidentiality can expose users’ payment history and potentially sensitive financial information.

The vulnerability exists in WWBN’s open‑source AVideo platform, affecting all releases 26.0 and earlier. Users running the BlockonomicsYPT plugin on those versions are exposed until they upgrade to later releases where the access restriction is enforced.

The CVSS score of 3.7 indicates low severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog, reinforcing its lower threat standing. The attack vector is a simple HTTP request to the publicly reachable /check.php endpoint, requiring no credentials. An attacker can enumerate any Bitcoin address that appears in the platform’s blockchain view, retrieving its associated payment orders without needing to authenticate or compromise the host system.