WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSRF vulnerability in playlistRemove.php. This vulnerability enables attackers to delete user playlists by skipping CSRF protection checks. Exploitation requires the victim to be authenticated and to visit a malicious page that submits a crafted POST request to playlistRemove.php.

Successful exploitation results in unauthorized deletion of playlists belonging to authenticated users. This can lead to loss of user data and disruption of user experience. There is no indication of privilege escalation or other impacts beyond playlist deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about visiting untrusted websites while authenticated in WWBN AVideo. Implementing additional CSRF protections or disabling playlist deletion functionality temporarily may reduce risk.