CVE-2026-92579
mediumIn AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin file…
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-3hg6-6x7m-5xr8 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/avideo-through-29.0-broken-access-control-via-csrf-ex... disclosure@vulncheck.com
- https://github.com/WWBN/AVideo/security/advisories/GHSA-3hg6-6x7m-5xr8 134c704f-9b21-4f2e-91b3-4a467353bcc0