CVE-2026-35452 is an information exposure vulnerability in WWBN AVideo (<= 26.0) affecting the CloneSite plugin. The client.log.php endpoint serves the clone operation log file without authentication, unlike other plugin endpoints that require admin privileges. The exposed log contains sensitive internal data such as filesystem paths, remote server URLs, and SSH connection metadata, potentially aiding an attacker in reconnaissance or further attacks. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 3.1 base score of 5.3 (medium severity). No patch or official remediation has been documented yet.

An unauthenticated attacker can access the clone operation log file via the client.log.php endpoint, gaining access to sensitive internal information including filesystem paths, remote server URLs, and SSH connection metadata. This exposure could facilitate further attacks or unauthorized access attempts. However, the vulnerability does not directly allow code execution or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the CloneSite plugin directory or specifically to the client.log.php endpoint through web server configuration or network controls to prevent unauthorized access. Monitor for updates from WWBN regarding patches or official mitigations.