CVE-2026-126543

WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php

8.7 High

WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen users_id to add wallet balance each billing cycle.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.24%Unchanged since Nov 11, 2026

What each source reports

CVE List Score used8.7

WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php

Record: CVE-2026-126543
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-345
Updated: 2026-11-11

EUVDEUVD-2026-1230688.7

Record: EUVD-2026-123068
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-11

GitHub AdvisoriesGHSA-r4j2-2784-v3cx8.7

WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin...

Record: GHSA-r4j2-2784-v3cx
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-345
Updated: 2026-11-11

NVD8.7

Record: CVE-2026-126543
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-345
Updated: 2026-11-11

OSV8.7

WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php

Record: CVE-2026-126543
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-345
Updated: 2026-11-12

Affected products

wwbn avideo

History

History
Recorded	Changed	Sources
Nov 11, 2026	aliases, references	NVD, OSV
Nov 11, 2026	published	EUVD
Nov 11, 2026	published	EUVD
Nov 11, 2026	aliases, references	GitHub Advisories
Nov 11, 2026	aliases, published	EUVD
Nov 11, 2026	first indexed	CVE List

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-126543 is a high vulnerability (CVSS 8.7) in Wwbn Avideo, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. No source names a fixed version.