CVE-2026-86725 is a high severity missing authorization flaw in the SocialMediaPublisher plugin of WWBN AVideo through commit c3edcc27. The add.json.php endpoint lets a logged-in user overwrite another user's stored access and refresh tokens, then take over the row. The GitHub advisory listed no patched version.
What's affected
Affected: WWBN AVideo up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-21 per the advisory). The file is plugin/SocialMediaPublisher/View/Publisher_user_preferences/add.json.php. The advisory lists patched versions as "None".
The sources agree on severity: the record gives CVSS 3.1 at 7.1 (High) and VulnCheck also shows 7.1 on CVSS 4.0. Any account with a session can do it, per the advisory. Nothing I read reports exploitation, and it is not in CISA KEV.
How to check if you're exposed
AVideo is usually installed from the project's Git repository, so the commit you run is the version. From the install directory:
git log -1 --format="%H %cd" --date=short
Compare the date and hash with the affected commit, c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23 per the GitHub advisory). Anything at or before that commit is in range. If you run a tagged release, note that the advisory names a master commit, so read the project's security advisories page for the first release or commit that fixes the issue.
Then check whether the plugin named in the advisory is present and enabled in your install (the plugin directory lists them), since an unused plugin is not exposed in the same way, although the files may still be on disk and reachable by URL.
What to do now
- Check your AVideo commit or release against the affected range above.
- Read the AVideo security advisories page for the first fixed commit or release, and update to it as soon as one is listed. At the time of writing the GitHub advisory showed patched versions as "None".
- Disable the SocialMediaPublisher plugin if it is not needed, and ask linked users to reconnect their accounts if you suspect tampering.
- Review web server and application logs for unusual requests to the endpoint named in this post.
- Treat the instance as sensitive: keep admin sessions short and avoid browsing other sites while logged in as an administrator.
Why it matters
This is another insecure direct object reference (CWE-639). The add endpoint builds a record from an id the caller supplies, then assigns it to the caller and saves it. The only check is that the caller is logged in. The sibling delete endpoint does compare the record's owner with the current user. The add path reaches the same rows without that check.
Overwriting a stored OAuth token record breaks the victim's link to their social media provider, and the advisory says the attacker can then delete the record to destroy the linkage. The effect is mostly integrity and availability of someone else's connection, with potential for posting under the wrong credentials in a publishing workflow.
If your AVideo site does not use the SocialMediaPublisher plugin, turning it off removes this path.
Quick check
Does the attacker need to be an admin?
No. The advisory says any account with a session can reach the endpoint.
What is the simplest mitigation?
Disable the SocialMediaPublisher plugin if you do not use it, and watch for an upstream fix.
Sources
Last reviewed: 18 October 2026.
