CVE-2026-82647: Cross-Site Request Forgery (CSRF) in WWBN AVideo

CVE-2026-82647 is a CSRF vulnerability in WWBN AVideo's sendEmail.json.php component. It allows an attacker to bypass origin and captcha protections to send emails from the site’s contact address when an authenticated administrator visits a malicious webpage. This can be exploited to send phishing emails that pass SPF/DKIM/DMARC checks, potentially damaging brand reputation and enabling targeted phishing campaigns. The vulnerability requires the victim to be an authenticated admin and involves no privilege escalation or direct remote code execution.

An attacker can leverage this vulnerability to send authenticated emails from the legitimate site’s contact address, facilitating phishing and brand impersonation attacks. This could lead to recipients trusting malicious emails, increasing the risk of credential theft or malware infection. The vulnerability does not allow direct system compromise but undermines email trust mechanisms and site reputation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and avoid visiting untrusted websites while authenticated. Monitor for suspicious email activity originating from the site’s contact address.