Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-123486

WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php…

Risk score
42/100
CVSS
5.3 v3.1
Published
6 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurri…
Affected
See advisory
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: php

References

Original description

WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.

Last activity 6 Nov 2026. Patch Forecast updates every hour.