An Insecure Direct Object Reference in the PayPalYPT agreementCancel.json.php file permits a low‑privilege authenticated user to cancel any PayPal billing agreement by supplying an arbitrary agreement ID. The code does not verify that the authenticated user owns the agreement, allowing an attacker to silently suspend a victim’s recurring subscription. This results in revenue loss for the platform and discontinuation of paid services for the victim, reflecting a medium impact on confidentiality of billing data and loss of service availability to the affected user.

All releases of WWBN AVideo up to and including version 29.0 contain the vulnerability. Users of these versions are at risk unless the breach‑fix commit is applied.

The CVSS score of 4.2 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires a legitimate, low‑privilege authenticated account and knowledge or acquisition of another user’s PayPal agreement ID, which is an IDOR scenario. The likelihood of exploitation is low but feasible if agreement IDs are exposed or shareable.