CVE-2026-88871 WWBN CVE debrief

Who should care

Defenders responsible for WWBN AVideo installations, particularly those with the CustomizeUser plugin enabled, should assess exposure and prioritize patching or mitigation. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders need to verify the presence of this vulnerability in their systems and apply patches or mitigations as available.

Why it matters

CVE-2026-88871 is a cross-site request forgery vulnerability in the CustomizeUser plugin of WWBN AVideo. Defenders should prioritize verifying the presence of this vulnerability, assessing exposure, and applying patches or mitigations as available.

• An attacker can forge the ExtraSubscribers count displayed on any user's channel
• Defenders need to verify the presence of this vulnerability in their systems
• Patching or mitigation is required to prevent exploitation
• Exposure assessment is necessary for systems with the CustomizeUser plugin enabled

Technical summary

The CustomizeUser plugin's setSubscribers.json.php endpoint in WWBN AVideo is vulnerable to cross-site request forgery. The script reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without requiring a POST request or a valid CSRF token. The mutation does not pass through ObjectYPT::save()/isUntrustedRequest(), so a cross-origin GET succeeds. An attacker can forge the ExtraSubscribers count displayed on any user's channel. The vulnerability is confirmed in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems and applying patches or mitigations as available.

Recommended defensive actions

• Verify the presence of the CustomizeUser plugin in your WWBN AVideo installation
• Assess exposure to the vulnerable endpoint
• Consider applying patches or mitigations as available
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The CustomizeUser plugin is enabled by default, but no patched version was available at the time of reporting.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.