Improper Payment Verification in WWBN AVideo by WWBN

CVE-2026-126543

What is CVE-2026-126543?

WWBN AVideo versions up to 29.7.1 are susceptible to an improper payment verification issue in the PayPal integration component (ipnV2.php). This vulnerability enables unauthenticated attackers to exploit the payment notification system, allowing them to impersonate genuine PayPal payment notifications and illicitly credit user wallets on the platform. By crafting a valid but unauthorized recurring payment notification, attackers can manipulate wallet balances using a chosen user ID, bypassing security controls meant to ensure that only legitimate transactions linked to the site's merchant account are processed.

References