WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master branch) contains a CSRF vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. This endpoint accepts a users_id parameter from $_REQUEST and calls User::swapUser() without enforcing POST-only requests or validating CSRF tokens. The global autoCSRFGuard() only applies to POST requests to *.json.php, but this action is reachable via GET, allowing an attacker to trigger it via cross-origin GET requests (e.g., an <img> tag). This causes an authenticated administrator's session to be swapped with a non-admin user account, removing admin privileges until the swap is reversed. Attempts to swap to another administrator account are rejected, preventing privilege escalation. Additionally, the JSON response leaks the session_id. The plugin is enabled by default, and no official fix or patch was available at the time of disclosure.

An attacker can cause an authenticated administrator to lose administrative access by swapping their session to a non-admin user account via a CSRF attack using a cross-origin GET request. This does not allow privilege escalation but can disrupt administrative control. The session_id disclosure could potentially aid further attacks. There is no indication of active exploitation in the wild. The vulnerability affects the default enabled CustomizeUser plugin in WWBN AVideo.

No official patch or fix was available at the time of publication. Administrators should be aware of the risk of CSRF attacks on the CustomizeUser plugin endpoint and consider disabling or restricting access to this plugin until a fix is released. Since the vulnerability is triggered via GET requests, applying web server rules to block unauthorized GET requests to plugin/CustomizeUser/swapUser.json.php or implementing additional CSRF protections may mitigate risk. Monitor vendor advisories for updates and official patches.