CVE-2026-34732: 
PHP vulnerability analysis and mitigation

CVE-2026-34732 is a missing authentication vulnerability in WWBN AVideo, an open source video platform, affecting versions 26.0 and prior. The CreatePlugin code generator template for list.json.php was shipped without any authentication or authorization check, unlike its sibling templates add.json.php and delete.json.php which both enforce admin-only access. This systemic omission propagates to every plugin built with the generator, resulting in 21 unauthenticated data listing endpoints across the platform. The vulnerability was published on March 30–31, 2026, with a CVSS v3.1 base score of 7.5 (High) per Feedly/NVD and 5.3 (Moderate) per the GitHub Advisory (GitHub Advisory, AVideo Advisory).

The root cause is CWE-306 (Missing Authentication for Critical Function): the CreatePlugin/templates/list.json.php template lacks the if (!User::isAdmin()) { die(...); } guard present in add.json.php and delete.json.php. Because the CreatePlugin code generator scaffolds CRUD endpoints from these templates, every plugin that uses it inherits the missing check in its generated list.json.php file. Exploitation requires no authentication, no special privileges, and no user interaction — an attacker simply sends an unauthenticated HTTP GET request to any of the 21 affected endpoints to receive a JSON response containing full database table records. A confirmed live-instance test showed the Meet plugin's join log endpoint returning user IDs, IP addresses, user agents, timestamps, and room names with an HTTP 200 response (AVideo Advisory).

Successful exploitation allows any unauthenticated remote attacker to retrieve sensitive data from 21 plugin endpoints, including user PII (email addresses, extended profile fields, user IDs), payment transaction logs from PayPal and Authorize.Net integrations (amounts, buyer details, webhook data), meeting access logs (IP addresses, user agents, room names, timestamps), social connection graphs, and user notification/activity history. There is no integrity or availability impact, but the confidentiality breach is broad and systemic — affecting all plugins generated with the CreatePlugin tool. The exposure of payment data and PII may carry regulatory implications under GDPR, PCI-DSS, and similar frameworks (AVideo Advisory, GitHub Advisory).

A proof-of-concept (PoC) with step-by-step curl commands and bash scripts targeting specific plugin endpoints is publicly available in the GitHub Security Advisory (AVideo Advisory). The PoC includes endpoint enumeration scripts and pagination examples that fully demonstrate data extraction from vulnerable instances. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.022% (6th percentile), indicating a currently low but non-zero probability of exploitation in the near term (GitHub Advisory).

1. Reconnaissance: Identify internet-facing WWBN AVideo instances (version ≤ 26.0) using search engines like Shodan or Censys, or by browsing to the target's /plugin/ directory listing.
2. Enumerate vulnerable endpoints: Run the published bash PoC script to iterate over known plugin endpoint paths (e.g., plugin/Meet/View/Meet_join_log/list.json.php, plugin/PayPalYPT/View/PayPalYPT_log/list.json.php) and check for HTTP 200 responses without sending any credentials.
3. Discover additional endpoints: Crawl the /plugin/ directory listing to find all installed plugins, then probe each plugin's View/ subdirectory for list.json.php files that return HTTP 200.
4. Extract data with pagination: Send paginated GET requests to confirmed vulnerable endpoints to retrieve full dataset contents:

   curl -s "https://target.com/plugin/Meet/View/Meet_join_log/list.json.php?length=100&start=0" | python3 -m json.tool
   curl -s "https://target.com/plugin/PayPalYPT/View/PayPalYPT_log/list.json.php?length=100&start=0" | python3 -m json.tool

5. Collect sensitive data: Parse the JSON responses to harvest user PII, payment transaction records, IP addresses, user agents, room names, and social graph data for further use or exfiltration (AVideo Advisory).

• Network: Unauthenticated HTTP GET requests to paths matching /plugin/*/View/*/list.json.php from external IP addresses; repeated requests with ?length= and ?start= pagination parameters suggesting automated data harvesting; unusual volume of requests to plugin endpoints from a single source IP.
• Logs: Web server access logs showing HTTP 200 responses to list.json.php endpoints under /plugin/ directories without any session cookie or authentication header; sequential pagination requests (e.g., start=0, start=100, start=200) to the same endpoint in rapid succession.
• File System: No file-system artifacts are expected for this read-only data disclosure vulnerability; however, review for any newly created scripts or tools in writable web directories that may indicate follow-on activity.
• Process: Unexpected outbound data transfers or connections from the web server process following access to plugin listing endpoints (AVideo Advisory).

At the time of initial publication, no patched version was available; however, a fix commit (WWBN/AVideo@ea9f555) has since been referenced in the GitHub Advisory Database (GitHub Advisory). Administrators should upgrade AVideo beyond version 26.0 as soon as a patched release is available. As an immediate workaround, add the following admin authentication check to CreatePlugin/templates/list.json.php and retroactively to all 21 existing generated list.json.php endpoints:

if (!User::isAdmin()) {
    die(json_encode(['error' => true]));
}

Additionally, implement network-level access controls (e.g., firewall rules or WAF policies) to restrict access to list.json.php endpoints under /plugin/ to trusted IP ranges, and review access logs for any prior unauthorized data access (AVideo Advisory).

The vulnerability was discovered and reported by aisafe-bot (aisafe.io) and credited to reporter adrgs, with the advisory published by DanielnetoDotCom on March 30, 2026 (AVideo Advisory). The issue was noted on Bluesky via the CVE tracking account shortly after publication. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified at this time.