The vulnerability in WWBN AVideo (<= 29.0) involves three admin-only JSON endpoints (`objects/categoryAddNew.json.php`, `objects/categoryDelete.json.php`, and `objects/pluginRunUpdateScript.json.php`) that lack CSRF token validation despite performing sensitive state-changing operations. These endpoints enforce only role-based access control but do not call `isGlobalTokenValid()` or `forbidIfIsUntrustedRequest()`, which are used to prevent CSRF attacks. This omission allows attackers to exploit a logged-in administrator's session by tricking them into visiting malicious web pages that trigger unauthorized category management or plugin update script execution. Peer endpoints in the same directory do enforce CSRF tokens, indicating this was an oversight. The vulnerability is tracked as CVE-2026-40926 with a CVSS 3.1 score of 7.1 (high severity). A patch addressing this issue is included in commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2.

Successful exploitation allows an attacker to perform unauthorized administrative actions such as creating or deleting categories and forcing execution of plugin update scripts within the context of an authenticated admin session. This can lead to unauthorized modification of the platform's content and potentially affect plugin behavior or integrity. The vulnerability does not directly impact confidentiality but has a high impact on integrity and a low impact on availability.

A fix for this vulnerability is available in commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2, which adds proper CSRF token validation to the affected endpoints. Users of WWBN AVideo version 29.0 or earlier should apply this update promptly to mitigate the risk. Until patched, administrators should avoid interacting with untrusted web content while logged into the platform to reduce exposure to CSRF attacks.