WWBN AVideo, an open source video platform, contains a missing authorization vulnerability (CWE-862) in the BlockonomicsYPT plugin's check.php endpoint in versions 26.0 and prior. This endpoint returns payment order data for any Bitcoin address without requiring authentication or access control. Since Bitcoin addresses are publicly visible on the blockchain, an unauthenticated attacker can retrieve payment information for any address used on the platform. The vulnerability has a CVSS 3.1 base score of 3.7, indicating low severity, with no known exploits or official remediation currently available.

The vulnerability allows unauthorized disclosure of payment order data associated with Bitcoin addresses used on the platform. This could lead to privacy concerns for users whose payment information is exposed. There is no impact on integrity or availability reported. The overall impact is limited to information disclosure of payment records.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be aware of the potential for unauthorized access to payment order data via the vulnerable endpoint. No vendor advisory or official remediation instructions have been provided at this time.