CVE-2026-92579CWE-289

CVE-2026-92579

Medium · published September 17, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-289 · Authentication Bypass by Alternate Name
Published
2026-09-17T02:18Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-3hg6-6x7m-5xr8 · [email protected]https://www.vulncheck.com/advisories/avideo-through-29.0-broken-access-control-via-csrf-exemption-basename-collision · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-3hg6-6x7m-5xr8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 21:46Z
    AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
    cvelistv5