CVE-2026-34737 WWBN CVE debrief

Who should care

Users of WWBN AVideo version 26.0 and prior who utilize Stripe subscriptions should verify their installations and consider updating or applying mitigations. This includes administrators, developers, and security teams responsible for managing and securing AVideo deployments. Additionally, operators and platform administrators should review the vulnerability and take necessary actions to prevent unauthorized subscription cancellation.

Technical summary

The StripeYPT plugin in WWBN AVideo versions 26.0 and prior contains a debug endpoint (test.php) accessible to any logged-in user. This endpoint can process Stripe webhook-style payloads, triggering subscription operations including cancellation. Due to a bug in the retrieveSubscriptions() method, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID. This vulnerability has a CVSS score of 6.5 and a severity of MEDIUM.

Defensive priority

Medium priority due to the potential for unauthorized subscription cancellation.

Recommended defensive actions

• Verify and restrict access to the StripeYPT plugin's debug endpoint
• Update AVideo to a version beyond 26.0 if available
• Implement additional monitoring for suspicious subscription cancellation activity
• Review and restrict Stripe subscription management permissions for users
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD details provide information on the vulnerability and affected versions. However, there is limited information on the vendor's remediation plan or available patches. Defenders should verify the affected scope, review official advisories, and monitor for suspicious activity. The StripeYPT plugin's debug endpoint allows unauthorized subscription cancellation, posing a medium priority risk. Users should review their installations and consider updating or applying mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.