The vulnerability in WWBN AVideo (<= 26.0) arises from improper authorization controls in the StripeYPT plugin's test.php debug endpoint. Although this endpoint should be restricted to administrators, it is accessible to all authenticated users. The endpoint processes Stripe webhook payloads and calls the retrieveSubscriptions() method, which erroneously cancels subscriptions instead of only retrieving them. This flaw enables any logged-in user to cancel any Stripe subscription by providing its subscription ID, leading to unauthorized subscription cancellations.

The vulnerability allows any authenticated user to cancel arbitrary Stripe subscriptions via the debug endpoint, potentially disrupting subscription services and causing denial of service to legitimate subscribers. There is no impact on confidentiality or availability beyond subscription cancellation. No known exploits are reported in the wild at the time of publication.

At the time of this report, no official patches or fixes are publicly available. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restricting access to the test.php debug endpoint to administrators only or disabling the StripeYPT plugin until a fix is released is recommended.