CVE-2026-35448

CVE-2026-35448 affects WWBN AVideo version 26.0 and earlier, specifically the BlockonomicsYPT plugin's check.php endpoint, which exposes payment order data for any Bitcoin address without requiring authentication. The endpoint was intended to serve as an authenticated AJAX polling helper but lacks access control validation, allowing unauthenticated attackers to retrieve sensitive payment records by querying publicly visible Bitcoin addresses used on the platform. The vulnerability carries a CVSS 3.7 low severity rating with a network-based attack vector and high attack complexity. Exploitation requires no privileges or user interaction and results in limited confidentiality impact, as attackers can only view payment information without modifying or disrupting services. The EPSS score of 0.00013 indicates minimal likelihood of exploitation in the wild compared to other disclosed vulnerabilities. There is no evidence of active exploitation, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence platforms. The low FAUCET risk score of 28.0 and minimal community attention suggest limited real-world impact and incentive for attacker development. Organizations running WWBN AVideo 26.0 or earlier should update to a patched version to restrict access to the check.php endpoint.