CVE-2026-34737
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
WWBN AVideo versions 26.0 and prior have a vulnerability in the StripeYPT plugin. The test.php endpoint is accessible to any logged-in user, not just administrators. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID.
Risk Assessment
An attacker can cancel other users' Stripe subscriptions, leading to service disruption and potential revenue loss.
Recommendation
Immediately restrict access to the test.php endpoint to administrators only and apply the patch once available.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the StripeYPT plugin includes a test.php debug endpoint that is accessible to any logged-in user, not just administrators. This endpoint processes Stripe webhook-style payloads and triggers subscription operations, including cancellation. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of merely retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID. At time of publication, there are no publicly available patches.