This vulnerability in WWBN AVideo arises because the execAsync() function improperly handles command escaping by re-wrapping escaped commands in double-quoted 'sh -c' calls. This allows an attacker to bypass the escapeshellarg() protection by injecting command substitution syntax such as $() and backticks. The flaw is exploitable via the Live plugin's on_publish.php endpoint, enabling remote attackers to execute arbitrary OS commands. The issue affects versions prior to 29.0 and represents an incomplete remediation of a previous vulnerability (CVE-2026-45578).

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands on the affected server, potentially leading to full system compromise. The vulnerability bypasses existing escaping protections, increasing the risk of unauthorized command execution and control over the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is described as affecting versions before 29.0 and the fix is incomplete, upgrading to version 29.0 or later may address the issue if confirmed by the vendor. Until an official fix or update is available, restrict access to the Live plugin's on_publish.php endpoint and monitor for suspicious activity related to command injection attempts.