CVE-2026-84208: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WWBN AVideo

CVE-2026-84208 is an unauthenticated SQL injection vulnerability affecting AVideo through version 29.0. The issue exists in the User_Location plugin's regions.json.php and cities.json.php endpoints, where the country and region GET parameters are directly embedded into SQL queries without escaping or using prepared statements. This allows attackers to perform UNION-based SQL injection attacks to read arbitrary database contents, including sensitive information such as password hashes. No official remediation or patch has been documented at this time.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL queries on the backend database, potentially exposing sensitive data including password hashes. This can lead to data disclosure and compromise of user credentials. The vulnerability has a high CVSS 4.0 score of 8.7, indicating a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints if possible and monitor for suspicious activity targeting these URLs. Avoid exposing the User_Location plugin endpoints publicly if feasible.