CVE-2026-34737: Wwbn Avideo

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the StripeYPT plugin includes a test.php debug endpoint that is accessible to any logged-in user, not just administrators. This endpoint processes Stripe webhook-style payloads and triggers subscription operations, including cancellation. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of merely retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID. At time of publication, there are no publicly available patches.

Affected products

• Wwbn Avideo: up to and including 26.0

Published 2026-03-31. Last modified 2026-07-24.