CSRF in Wwbn Avideo
CVE-2026-88871
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without requiring a POST request or a valid CSRF token; autoCSRFGuard() is applied only to POST requests to *.json.php, and the mutation does not pass through ObjectYPT::save()/isUntrustedRequest(), so a cross-origin GET succeeds. An unauthenticated remote attacker who induces a logged-in administrator to load a crafted page (for example an <img> tag pointing at the endpoint) can forge the ExtraSubscribers count displayed on any user's channel. The CustomizeUser plugin is enabled by default, and no patched version was available at the time of reporting.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (7.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 7.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/WWBN/AVideo/security/advisories/GHSA-p9c3-prq7-g8xc (vendor-advisory)
- www.vulncheck.com/advisories/wwbn-avideo-customizeuser-setsubscribers-csrf-via-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-88871?
- CVE-2026-88871 is a medium-severity vulnerability in Wwbn Avideo, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2026-09-10.
- How severe is CVE-2026-88871?
- Medium severity. CVSS v3 base score is 4.3 out of 10.