CVE-2026-88871

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without requiring a POST request or a valid CSRF token; autoCSRFGuard() is applied only to POST requests to *.json.php, and the mutation does not pass through ObjectYPT::save()/isUntrustedRequest(), so a cross-origin GET succeeds. An unauthenticated remote attacker who induces a logged-in administrator to load a crafted page (for example an <img> tag pointing at the endpoint) can forge the ExtraSubscribers count displayed on any user's channel. The CustomizeUser plugin is enabled by default, and no patched version was available at the time of reporting.

• CWE-352

• https://github.com/WWBN/AVideo/security/advisories/GHSA-p9c3-prq7-g8xc
• https://www.vulncheck.com/advisories/wwbn-avideo-customizeuser-setsubscribers-csrf-via-get
• https://github.com/WWBN/AVideo/security/advisories/GHSA-p9c3-prq7-g8xc

Published

Sep 10, 2026

Last Modified

Sep 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88866WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…8.7
• CVE-2026-88867WWBN AVideo, in versions up to and including commit c3edcc27…8.7
• CVE-2026-88868AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
• CVE-2026-88869AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…9.3
• CVE-2026-8887The Listen Shortcode plugin for WordPress is vulnerable to S…6.4
• CVE-2026-88870WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…7.1
• CVE-2026-88872AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…7.1
• CVE-2026-88873WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…7.1
• CVE-2026-88874AVideo through revision c3edcc274c389816d434acadac07ee78eaf3…7.5
• CVE-2026-88875AVideo through revision c3edcc274c389816d434acadac07ee78eaf3…4.3
• CVE-2026-88876AVideo through revision c3edcc274c389816d434acadac07ee78eaf3…7.5
• CVE-2026-88877Traefik is a HTTP reverse proxy and load balancer. In versio…9.8