CVE-2026-126804

WWBN AVideo versions 12.4 through 29.7.1 are vulnerable to a path traversal vulnerability in the ADs plugin's deleteImage.json.php file. This flaw allows authenticated users with custom ads to delete arbitrary files by providing an unvalidated is_regular_user parameter, which can be set to anothe...