WWBN AVideo: Improper payment verification in PayPal IPN handler
Summary
WWBN AVideo through 29.7.1 does not properly verify PayPal recurring-payment notifications in plugin/PayPalYPT/ipnV2.php. An unauthenticated attacker can forward genuine, verified IPNs from their own PayPal account and choose the target users_id, so the site credits wallet balance for that user on each billing cycle. The exploit requires the PayPalYPT and YPTWallet plugins to be enabled. The referenced vendor commit changes the IPN handling in ipnV2.php.
Affected
- WWBN AVideo 0 through 29.7.1 (according to the CVE record)
- Relevant only if the PayPalYPT and YPTWallet plugins are enabled
Fixed in
Unknown. The referenced commit 98406b7944e035e72082665ac886d78fc3af0a7f changes ipnV2.php, but no fixed release is confirmed.
Workaround
Unknown. No vendor workaround is confirmed for this CVE.
- Until a fix is confirmed, review wallet credits and subscription renewals for unexpected entries.
- Where your setup allows, restrict access to the PayPal IPN endpoints and check that changes do not break legitimate payments.
Exploitation
- Exploited in the wild: nothing found.
- Public proof of concept: nothing found for this CVE.
- NVD status: Deferred. NVD analysis was pending at publication.
Our recommendation
- Check whether any customer runs AVideo with PayPalYPT or YPTWallet enabled, and which version.
- Obtain the fixed release from the vendor advisory GHSA-5gg3-9jhh-xf86 or the referenced commit, then update affected sites.
- Audit recent wallet credits and subscription renewals on affected sites.
- Re-check this CVE in a few days, as NVD analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AVideo ipnV2.php at v29.7.1 (GitHub) github.com
- Commit 98406b7 (GitHub) github.com
- GitHub Security Advisory GHSA-5gg3-9jhh-xf86 github.com
- VulnCheck advisory: WWBN AVideo wallet credit manipulation www.vulncheck.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:21.
Original description (NVD)
WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen users_id to add wallet balance each billing cycle.
NVD references (5)
- https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/PayPalYPT/ipnV2.php#L87-L125
- https://github.com/WWBN/AVideo/commit/98406b7944e035e72082665ac886d78fc3af0a7f
- https://github.com/WWBN/AVideo/security/advisories/GHSA-5gg3-9jhh-xf86
- https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-wallet-credit-manipulation-via-paypalypt-ipnv…
- https://github.com/WWBN/AVideo/security/advisories/GHSA-5gg3-9jhh-xf86
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.