What is the CVSS score of CVE-2026-39366?

CVE-2026-39366 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-39366

EUVD-2026-19878 MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-04-07 GitHub_M

GHSA-mmw7-wq3c-wf9p

Information Disclosure PHP

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19878

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 19:21 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans.

AnalysisAI

Replay attack in WWBN AVideo versions 26.0 and prior allows authenticated attackers to repeatedly submit legitimate PayPal IPN notifications to the v1 handler, inflating wallet balances and renewing subscriptions without additional payment. The vulnerability exploits missing transaction deduplication in plugin/PayPalYPT/ipn.php, while newer v2 handlers correctly implement deduplication. CVSS 6.5 reflects high integrity impact with network accessibility and low attack complexity, though exploitation requires valid subscription credentials.

Technical ContextAI

WWBN AVideo integrates PayPal Instant Payment Notification (IPN) handlers to process billing transactions. The legacy ipn.php handler (PayPal IPN v1) lacks deduplication logic that compares incoming notifications against PayPalYPT_log entries-a mechanism correctly implemented in newer ipnV2.php and webhook.php handlers. Without idempotency checks, an attacker with a valid subscription account can capture a legitimate IPN message and resend it multiple times, causing the system to process the same transaction repeatedly. CWE-345 (Insufficient Verification of Data Authenticity) indicates the root cause: the handler fails to verify that a transaction has already been recorded before applying its effects. The vulnerability persists because the legacy v1 handler remains actively referenced in billing plan configurations as the notify_url parameter.

RemediationAI

Upgrade to a version of WWBN AVideo beyond 26.0 that includes the deduplication fix, or manually apply the fix from commit 8f53e9d9c6aaa07d51ace30691981edbbfb5ca1c to plugin/PayPalYPT/ipn.php. The fix implements transaction deduplication by cross-referencing incoming PayPal IPN notifications against existing PayPalYPT_log entries before processing-matching the logic in ipnV2.php and webhook.php. As an interim workaround, disable or remove the legacy v1 handler and redirect PayPal notify_url settings to ipnV2.php or webhook.php if supported by your deployment. Consult GitHub Security Advisory GHSA-mmw7-wq3c-wf9p and the vendor commit for detailed implementation guidance.