Three administrative JSON endpoints in WWBN AVideo – categoryAddNew.json.php, categoryDelete.json.php, and pluginRunUpdateScript.json.php – validate only user role but omit CSRF token checks. This allows an attacker who lures a logged‑in administrator to a malicious page to create, delete or modify categories, and to trigger any installed plugin’s updateScript() method in the admin’s session. The absence of token validation is an omission, not a deliberate design choice, and the plugin update script execution can result in arbitrary code running on the server, giving the attacker full control over the system’s data and possibly the host. The vulnerability demonstrates a classic CSRF flaw (CWE‑352).

WWBN AVideo, versions 29.0 and earlier, including any installations that have not applied the fix commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2.

The vulnerability has a CVSS score of 7.1, indicating high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, but the presence of CSRF token omission and the ability to execute arbitrary plugin code make exploitation highly likely for attackers who can target logged‑in administrators. Likely attack vectors involve web‑based CSRF or social‑engineering techniques to trick an admin into visiting a crafted URL.