WWBN AVideo versions 26.0 and prior contain a missing authorization vulnerability (CWE-862) in the BlockonomicsYPT plugin's check.php endpoint. This endpoint returns payment order data for any Bitcoin address without verifying the requester's authentication or authorization. Since Bitcoin addresses are publicly visible, an attacker can retrieve payment information for any address used on the platform by querying this endpoint. The vulnerability has a CVSS 3.1 base score of 3.7 (low severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact. There is no vendor-provided patch or official remediation at this time.

An unauthenticated attacker can access payment order data associated with any Bitcoin address used on the platform by querying the vulnerable endpoint. This leads to limited confidentiality impact as payment information may be exposed without authorization. There is no impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the check.php endpoint or implement additional access controls to prevent unauthorized queries. Monitor for updates from WWBN regarding patches or mitigations.