In WWBN AVideo versions up to 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames that are checked without considering directory context. This design flaw allows plugin files that share names with core files to inherit CSRF exemptions improperly. The LoginWordPress plugin file login.json.php benefits from this exemption and unconditionally logs out authenticated users on cross-site POST requests before any credential validation occurs. This behavior can be exploited to bypass authentication mechanisms, leading to unauthorized access.

The vulnerability allows an attacker to bypass authentication controls by exploiting the CSRF exemption inherited by the login.json.php plugin file. This can lead to unauthorized logout of authenticated users and potentially unauthorized access if the attacker can manipulate session states or authentication flows. The CVSS 4.0 score of 5.3 indicates a medium severity impact with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions or disable the vulnerable LoginWordPress plugin if feasible. Monitor vendor communications for official patches or temporary mitigations.