WWBN AVideo versions up to 29.0 contain an improper verification of the source of a communication channel (CWE-940) in the sendEmail.json.php endpoint. When the contactForm parameter is omitted, the endpoint sets the recipient email address ($sendTo) to an attacker-controlled value and uses the site's own contact email as the From/Reply-To address. This endpoint is allow-listed as a public write action without requiring authentication or CSRF protection. Consequently, an unauthenticated attacker who can solve a captcha can abuse the site's SMTP infrastructure to send arbitrary emails that appear to originate legitimately from the site's domain, potentially bypassing email authentication mechanisms such as SPF, DKIM, and DMARC. This vulnerability enables phishing and brand impersonation attacks. A code commit (4e3709895857a5857f0edb46b0ee984de0d9e1a2) contains a fix, but no official patch or advisory is currently available.

The vulnerability allows unauthenticated attackers to send emails from the affected server's legitimate SMTP infrastructure using the site's own domain in the From/Reply-To fields. This can be exploited to conduct targeted phishing campaigns and brand impersonation attacks that are more likely to bypass email authentication controls (SPF, DKIM, DMARC). There is no direct impact on confidentiality or availability reported. No known exploits in the wild have been documented at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A code commit fixing the issue has been identified, but no official patch or vendor advisory is currently available. Until an official fix is released, consider restricting access to the vulnerable endpoint or implementing additional verification controls to prevent unauthenticated abuse. Monitor vendor channels for updates and apply the official fix once available.