WWBN AVideo versions 26.0 and prior have a CSRF vulnerability in the admin plugin configuration endpoint (admin/save.json.php) due to missing CSRF token validation calls such as isGlobalTokenValid() or verifyToken(). The SameSite=None cookie policy enables cross-origin requests to carry authentication cookies, and the plugins table is excluded from standard table-level security checks, allowing attackers to overwrite arbitrary plugin settings. This can lead to a complete takeover of platform functionality by modifying critical configurations like payment processors, authentication providers, and cloud storage credentials. No patches are currently available.

Successful exploitation allows an attacker to perform unauthorized configuration changes on the AVideo platform by forging requests from a victim administrator's browser. This can result in full platform compromise, including control over payment processing, authentication mechanisms, and cloud storage credentials. The vulnerability does not affect availability but has high impact on confidentiality and integrity.

At the time of this report, no official patches or fixes are available. Administrators should apply strict access controls to the admin interface and consider disabling or restricting the vulnerable plugin configuration endpoint until a fix is released. Monitoring for suspicious administrative changes is advised. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.