---
id: CVE-2026-92579
title: >-
  In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded
  allowlist of exempt basenames tested without directory context, allowing
  plugin files matching core filenames to inherit CSRF exemptions
summary: >-
  In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded
  allowlist of exempt basenames tested without directory context, allowing
  plugin files matching core filenames to inherit CSRF exemptions. The
  LoginWordPress plugi…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'
cwe:
  - CWE-289
vendor: WWBN
product: AVideo
affected:
  - AVideo <= 29.0
published: '2026-09-16'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T21:18:46.057'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92579'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-3hg6-6x7m-5xr8'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/avideo-through-29.0-broken-access-control-via-csrf-exemption-basename-collision
    label: disclosure@vulncheck.com
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-3hg6-6x7m-5xr8'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00157
epssPercentile: 0.05269
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T20:13:48.770637Z'
ingestedAt: '2026-09-16T22:06:50.933Z'
---

## Overview

In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.