CVE-2026-33507 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a remote code execution caused by lack of CSRF protection in pluginImport.json.php endpoint combined with session.cookie_samesite='None', letting unauthenticated attackers execute code via admin user interaction.

Severity & Score

Impact

Unauthenticated attackers can achieve remote code execution by tricking an admin to upload a malicious plugin, leading to full server compromise.

Mitigation

Update to a version including commit d1bc1695edd9ad4468a48cea0df6cd943a2635f3 or later.

References

• https://github.com/WWBN/AVideo/commit/d1bc1695edd9ad4468a48cea0df6cd943a2635f3
• https://github.com/WWBN/AVideo/security/advisories/GHSA-hv36-p4w4-6vmj

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 23, 2026

🟠 CVE-2026-33507 - High (8.8) WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php` endpoint allows admin users to upload and install plugin ZIP files containing executable PHP code, but lacks any CSRF protectio... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33507/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner