WWBN AVideo versions 26.0 and earlier contain a CSRF vulnerability in the pluginSwitch.json.php endpoint. This endpoint permits authenticated administrators to enable or disable any installed plugin but lacks CSRF token validation. Additionally, the plugins table is excluded from ORM-level Referer/Origin domain validation, further weakening protections. Because session cookies are set with SameSite=None, an attacker can craft malicious web pages that cause an admin to unknowingly disable security-critical plugins such as two-factor authentication or access control. This combination of missing CSRF protection and cookie settings enables unauthorized modification of plugin states via CSRF attacks. No official patches or fixes are available as of the publication date.

An attacker can exploit this vulnerability to disable important security plugins by tricking an authenticated administrator into visiting a malicious webpage. This can lead to the removal of protections like two-factor authentication, subscription enforcement, or access control, significantly weakening the security posture of the affected AVideo installation. The vulnerability does not directly disclose data or cause denial of service but facilitates further attacks by reducing security controls.

At the time of publication, no official patches or fixes are available for this vulnerability. Administrators should exercise caution and avoid visiting untrusted websites while logged into the AVideo administration interface. Monitoring for suspicious activity related to plugin state changes is recommended. Check the vendor's advisory channels regularly for updates or patches addressing this issue.