CVE-2026-89251: Wwbn Avideo

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests to mint YPTWallet balance for any campaign video without proof an ad actually played.

Affected products

• Wwbn Avideo

Published 2026-09-11. Last modified 2026-09-11.