WWBN AVideo up to version 29.0 contains an improper verification of the source of a communication channel vulnerability (CWE-940) in the objects/sendEmail.json.php endpoint. This endpoint is allow-listed as a public write action and requires no authentication or CSRF token. When the contactForm parameter is omitted, the endpoint sets the recipient email to an attacker-supplied value and uses the site's contact email as the sender. An unauthenticated attacker who can solve a captcha can exploit this to send arbitrary emails from the site’s domain, potentially facilitating phishing or brand impersonation. A fix is referenced in commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2, but no official patch or vendor advisory is provided in the input.

The vulnerability allows attackers to send emails from the legitimate domain of the affected site without authentication, potentially enabling targeted phishing campaigns and brand impersonation. The emails pass SPF, DKIM, and DMARC checks, increasing their likelihood of bypassing spam filters. There is no indication of direct confidentiality or availability impact. No known exploits in the wild are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The input references a commit containing a fix, but no official patch or advisory is provided. Until an official fix is applied, consider restricting access to the vulnerable endpoint or implementing additional verification to prevent abuse. Avoid relying solely on captcha as a defense.