CVE-2026-34737 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a broken access control vulnerability caused by a test.php debug endpoint in the StripeYPT plugin that allows authenticated users to cancel arbitrary Stripe subscriptions, exploit requires user authentication.

Severity & Score

Impact

Authenticated users can cancel arbitrary Stripe subscriptions, disrupting service and causing denial of subscription access.

Mitigation

Update to the latest version once a patch is available or disable the StripeYPT test.php endpoint.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-38rh-4v39-vfxv

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner