CVE-2026-86724: Cross-Site Request Forgery (CSRF) in WWBN AVideo

The vulnerability exists in the AVideo plugin YPTWallet at the saveBalance.php script, where there is no CSRF token validation. Attackers can exploit this by crafting a malicious webpage that submits a POST request to set arbitrary wallet balances, leveraging the administrator's session cookies. This flaw allows unauthorized wallet balance changes without requiring additional privileges or user interaction beyond visiting the malicious page.

An attacker can modify any user's wallet balance arbitrarily by exploiting the CSRF vulnerability, potentially leading to financial manipulation or fraud within the affected system. The vulnerability requires the victim to be an authenticated administrator who visits a malicious webpage, which then triggers the unauthorized balance modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid visiting untrusted websites while authenticated. Implementing CSRF token validation in the affected endpoint is recommended once a patch is released.