CVE-2026-34732 Details

A vulnerability exists in WWBN AVideo versions through 26.0, where the CreatePlugin template for list.json.php lacks authentication and authorization checks. This oversight allows unauthenticated access to data listing endpoints generated by this template, exposing sensitive information such as user personal identifiable information (PII), payment transaction logs, IP addresses, user agents, and internal system records. While the add.json.php and delete.json.php templates require admin privileges, the list.json.php template was released without such a safeguard. As a result, 21 unauthenticated data listing endpoints across various plugins are affected.

To address this vulnerability, add an admin authentication check to the CreatePlugin/templates/list.json.php file, following the pattern used in the add.json.php and delete.json.php templates. After updating the template, retroactively patch all existing generated list.json.php endpoints by adding the same admin check.