WWBN AVideo versions 26.0 and earlier are vulnerable to remote code execution, which can be triggered by an attacker via cross-site request forgery.

The saveSort.json.php endpoint in the Gallery plugin improperly handles user input by passing unsanitized data into a PHP eval() function. Although the function requires administrative privileges, the lack of CSRF protection allows an unauthenticated attacker to execute arbitrary code by tricking an administrator into visiting a malicious page.

The vulnerability carries a high CVSS score of 8.8, reflecting the severe potential for full system compromise. Successful exploitation grants the attacker remote code execution capabilities, which could lead to complete data theft, unauthorized system control, and significant reputational damage to the organization hosting the video platform.

Immediate Action: Since no official patch is currently listed, users should restrict access to the Gallery plugin or disable it entirely until a vendor-supplied update is available.

Proactive Monitoring: Review web access logs for unusual requests to saveSort.json.php and monitor administrative account activity for unauthorized configuration changes.

Compensating Controls: Implement a strict Web Application Firewall (WAF) rule to block requests to saveSort.json.php that do not originate from trusted administrative sessions and enforce strict Referer header validation.

Public Exploit Available: No (the referenced GitHub security advisory provides technical details for research purposes, but does not constitute a weaponized exploit).

Given the potential for remote code execution and the existence of proof-of-concept details, this vulnerability presents a significant risk to the integrity of the AVideo platform. Administrators should treat this as a high-priority item, implementing the suggested compensating controls immediately and monitoring vendor channels for the release of a permanent fix.