CVE-2026-88871 describes a CSRF vulnerability in WWBN AVideo's CustomizeUser plugin. The vulnerability exists because the setSubscribers.json.php endpoint reads parameters from $_REQUEST and calls User::setExtraSubscribers() without enforcing a POST request or validating a CSRF token. The autoCSRFGuard() protection applies only to POST requests to *.json.php endpoints, and the mutation bypasses ObjectYPT::save()/isUntrustedRequest() checks, allowing cross-origin GET requests to succeed. An attacker can exploit this by tricking a logged-in administrator into loading a crafted page, such as an image tag referencing the vulnerable endpoint, to manipulate subscriber counts on any user's channel. The plugin is enabled by default, and no patch was available at the time of disclosure.

An unauthenticated remote attacker can exploit this vulnerability to perform unauthorized state changes on the AVideo platform by leveraging a logged-in administrator's session. Specifically, the attacker can forge the ExtraSubscribers count displayed on any user's channel, potentially misleading users or affecting platform integrity. The vulnerability does not require privileges or user interaction beyond loading a crafted page, increasing its risk. However, no known exploits in the wild have been reported.

No official fix or patch was available at the time of reporting. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. As a temporary mitigation, administrators should avoid visiting untrusted web pages while logged into the AVideo platform. Additionally, disabling or restricting the CustomizeUser plugin until a fix is released may reduce exposure.