The vulnerability originates in the cloneSite plugin of WWBN AVideo when it constructs and executes a wget command via exec() with user-controlled input from the url parameter. This allows an attacker to inject arbitrary shell commands by inserting shell metacharacters, leading to Remote Code Execution on the server. The weakness is a classic command injection flaw (CWE‑77) that directly compromises confidentiality, integrity, and availability of the host system.

WWBN AVideo, specifically the CloneSite plugin, is affected in all releases 29.0 and older. The vulnerable endpoint cloneServer.json.php is included in these versions.

The CVSS score of 8.9 indicates high severity, and while an EPSS score of 1% indicates a low probability of exploitation, the lack of KEV listing does not diminish the risk of exploitation. It is inferred that the flaw can be exploited remotely via any network exposed instance of the vulnerable endpoint, requiring only a crafted URL. The vulnerability does not depend on local privileges and can execute arbitrary commands with the permissions of the web server process.