CVE-2026-33478

CVE-2026-33478 describes a critical remote code execution (RCE) vulnerability affecting WWBN AVideo versions up to and including 26.0. This RCE is achieved by chaining multiple flaws within the CloneSite plugin, allowing a completely unauthenticated attacker to compromise the system. Rated 10.0 Critical, the vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Successful exploitation grants an attacker full control over the affected system, including arbitrary command execution. While not currently listed on CISA KEV or the Hot List, and with no public exploit code available, its low EPSS score suggests a relatively low probability of exploitation in the wild despite minimal community discussion.