This vulnerability in WWBN AVideo versions prior to 29.0 involves improper neutralization of special elements used in OS commands. The execAsync() function re-wraps already escaped commands in double-quoted sh -c, which permits command substitution using shell constructs like $() and backticks. As a result, attackers can bypass escapeshellarg() protections and inject arbitrary OS commands via the Live plugin's on_publish.php endpoint. This represents an incomplete remediation of CVE-2026-45578, leaving the application vulnerable to remote command execution without authentication or user interaction.

Successful exploitation allows unauthenticated attackers to execute arbitrary operating system commands on the affected server. This can lead to full system compromise, data theft, service disruption, or further attacks within the environment. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is described as present in versions before 29.0 and involves an incomplete fix, upgrading to version 29.0 or later may address the issue if the vendor has released a complete fix. Until an official fix is confirmed, restrict access to the Live plugin's on_publish.php endpoint and monitor for suspicious activity. Avoid relying solely on escapeshellarg() for command sanitization in this context.