Path Traversal Vulnerability in WWBN AVideo ADs Plugin

CVE-2026-126804

What is CVE-2026-126804?

The WWBN AVideo software versions 12.4 to 29.7.1 exhibit a path traversal vulnerability in the ADs plugin, specifically in the deleteImage.json.php file. This issue permits authenticated users, particularly those with custom advertisements, to exploit the unvalidated 'is_regular_user' parameter, potentially allowing them to delete files belonging to other users—including critical files like videos and configuration settings. Such unauthorized file deletions could lead to denial of service, effectively taking the site offline and exposing sensitive components like the installer.

References