The vulnerability in the AuthorizeNet/processPayment endpoint allows authenticated users to arbitrarily inflate their wallet balance. The endpoint ignores all transaction validation, hardcodes a successful payment flag, and adds the supplied amount directly to the user’s wallet. This flaw provides a clear path to inflate credits without performing any legitimate payment transaction, effectively bypassing financial controls and enabling fraud or abuse of in‑platform services. The weakness is classified as CWE-345, reflecting the misuse of internal system data without proper validation.

WWBN AVideo versions 29.0 and earlier are affected when both the AuthorizeNet and YPTWallet plugins are enabled and the processPayment.json.php endpoint is accessible to authenticated users. The issue is confined to platforms using these plugins and does not affect earlier migrations or custom deployments that have removed or altered the endpoint.

The CVSS score of 7.1 indicates a moderate risk level, primarily due to the necessity of user authentication and plugin availability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no current public exploits. Attackers require legitimate login credentials and the presence of the vulnerable plugins; from that position, they can repeatedly add funds to their own wallet, compromising the system’s financial integrity.