CVE-2026-34613 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a cross-site request forgery caused by missing CSRF token validation in objects/pluginSwitch.json.php and bypassed ORM security checks, letting attackers disable critical plugins via admin session and crafted requests.

Severity & Score

Impact

Attackers can disable critical security plugins by tricking an admin, potentially weakening site security and enabling further attacks.

Mitigation

Update to the latest version once patches are available or implement CSRF token validation and restrict plugin modification endpoints.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-hqxf-mhfw-rc44

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner