CVE-2026-35448
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
WWBN AVideo versions 26.0 and prior have a vulnerability in the BlockonomicsYPT plugin's check.php endpoint. The endpoint returns payment order data for any Bitcoin address without requiring authentication, allowing an attacker to query payment records for any address used on the platform.
Risk Assessment
An attacker can access sensitive transaction data of users, compromising privacy and potentially leading to financial information leakage.
Recommendation
Immediately update WWBN AVideo to the latest version and implement access controls for the check.php endpoint.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated invoice.php page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform.