Missing Authentication in WWBN AVideo Plugin Allows Unauthorized Access
CVE-2026-90539

6.9MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
12 September 2026

What is CVE-2026-90539?

The WWBN AVideo plugin has a vulnerability that allows unauthenticated attackers to access inactive admin menu items via the menuItems.json.php endpoint. By sending a specially crafted POST request containing a menuId parameter, attackers can retrieve hidden URLs of menu items, including sensitive query parameters that should not be publicly exposed. This oversight in access control can lead to unauthorized disclosure of potentially sensitive information, highlighting the importance of robust authentication mechanisms in web applications.

Affected Version(s)

AVideo 0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-h...
vendor-advisory
https://www.vulncheck.com/advisories/wwbn-avideo-missing-...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

santhreal
.