Vulnerability Description
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-3hg6-6x7m-5xr8
- https://www.vulncheck.com/advisories/avideo-through-29.0-broken-access-control-v
- https://github.com/WWBN/AVideo/security/advisories/GHSA-3hg6-6x7m-5xr8
FAQ
What is CVE-2026-92579?
CVE-2026-92579 is a vulnerability with a CVSS score of 5.4 (MEDIUM). In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF...
How severe is CVE-2026-92579?
CVE-2026-92579 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92579?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.