This vulnerability occurs in the PayPal IPN version 1 handler (plugin/PayPalYPT/ipn.php) of WWBN AVideo. The handler lacks transaction deduplication, allowing an attacker to replay a legitimate PayPal IPN notification. Each replay inflates the victim's wallet balance and can renew subscription services, resulting in unauthorized financial gain for the attacker. The weakness is a classic replay attack (CWE‑345) and directly affects the integrity of wallet balances and subscription status.

The affected product is WWBN AVideo, an open‑source video platform. All releases up to and including version 26.0 are vulnerable, because the v1 IPN handler was never updated. Versions 26.1 and later contain the corrected ipnV2.php and webhook.php handlers that perform proper deduplication. Systems still using the old notify_url in PayPal billing plans are at risk.

The CVSS base score is 6.5, indicating moderate severity. The exploit does not require privileged access; an attacker only needs to send replayed IPN messages to the configured notify_url. Because the vulnerability is driven by a missing server‑side check, it can be executed remotely with minimal effort. The EPSS score is not publicly available, and the issue is not listed in the KEV catalog, so the current likelihood of exploitation is uncertain but potentially significant in environments where the PayPal IPN v1 endpoint is exposed.