The bug resides in the CustomizeUser plugin endpoint. It accepts a users_id from the request and calls User::swapUser() without validating that the request is a POST or has a valid CSRF token. Since the global guard only runs on POSTs to *.json.php, the action is reachable via a GET request. An attacker can coerce an administrator's browser to issue a cross‑origin GET, for example with an image tag or a link, and swap the administrator's session with a non‑administrator account. The JSON response reveals the session_id, adding an information‑disclosure element. The attacker cannot elevate privileges to another administrator, so the vulnerability is limited to session hijacking and loss of administrative control.

The affected product is WWBN AVideo, which ships with the CustomizeUser plugin enabled by default. The flaw appears in the commit c3edcc274c389816d434acadac07ee78eaf330c1 on the master branch. No specific version numbers are listed, so any installation using the default plugin configuration is potentially vulnerable until a patch is released.

The CVSS score of 5.3 indicates a medium impact. The EPSS score is not currently available, and the vulnerability is not listed in the CISA KEV catalog, so there is no documented exploitation activity at present. However, the flaw can be trivially exploited wherever an authenticated administrator is prompted to load content from a malicious site, making it reasonably likely in real‑world scenarios. The lack of a mitigation in the code and the ease of construction of a malicious GET request raise the overall risk. Attackers can temporarily lose administrative access, causing potential service disruption and loss of control over the system until the administrator regains the session.