A cross‑site request forgery flaw exists in the CustomizeUser plugin’s setSubscribers.json.php endpoint of WWBN AVideo. The endpoint accepts users_id and ExtraSubscribers parameters from any request and blindly invokes User::setExtraSubscribers() without enforcing a POST method or validating a CSRF token. Because the CSRF guard is applied the standard checks, a cross‑origin GET request can successfully modify the channel.

All installations of WWBN AVideo that include the default‑enabled CustomizeUser plugin before the fix are affected. The plugin is part of the core codebase, and no patched package was available at the time of disclosure.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, implying that there is no publicly known exploitation yet. Exploitation requires an unauthenticated remote attacker to get a logged‑in administrator to load a crafted page that triggers the vulnerable GET endpoint—this social‑engineering step is explicitly described in the advisory.