WWBN AVideo CVE-2026-89251

Exploitation requires an active authenticated session on the AVideo platform - a free user account is sufficient (CVSS PR:L). The AD_Server plugin must be installed and active, and YPTWallet-linked campaign videos must exist on the platform. The attacker must be able to reach plugin/AD_Server/log.php over the network (CVSS AV:N). No elevated privileges, administrative access, or non-default configuration beyond AD_Server plugin activation is required. Exploitation is limited to integrity fraud within the platform's ad economy; it does not expose credentials, system files, or enable code execution.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) is consistent with the description: low-complexity network exploitation by any authenticated user with high integrity impact and no confidentiality or availability consequences. The vulnerability is limited to financial integrity within the AVideo ecosystem - specifically YPTWallet balances - rather than system compromise or data exfiltration. Real-world risk is meaningful for platforms relying on AVideo's ad revenue model, as the fraud is scalable and fully automatable via scripted POST requests. However, the blast radius is confined to platforms actively using the AD_Server plugin with YPTWallet-linked campaigns. No EPSS score, KEV status, or public exploit code is present in the available data. The GitHub Security Advisory (GHSA-cwrf-q9jv-44px) provides vendor acknowledgment, lending credibility to the report.

An attacker registers a free account on an AVideo instance running the AD_Server plugin, then scripted HTTP POST requests targeting plugin/AD_Server/log.php with the parameter label=start are sent in rapid succession, each crediting the attacker's campaign video owner wallet without any ad being displayed. Because the endpoint performs no rate limiting or delivery verification, thousands of fake impressions can be submitted in minutes, minting arbitrary YPTWallet balance for any targeted campaign owner.