{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"29.0"}],"component":"wwbn/avideo","cve_ids":["CVE-2026-43883"],"ecosystem":"Packagist","epss":0.00252,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-958h-qp3x-q4gj","id":"tcs_01M5KEZP2PYBKQCQATXAF5BESJ","modified_at":"2026-05-13T14:33:28.337773Z","published_at":"2026-05-05T22:16:12Z","references":["https://osv.dev/vulnerability/GHSA-958h-qp3x-q4gj","https://github.com/WWBN/AVideo/security/advisories/GHSA-958h-qp3x-q4gj","https://nvd.nist.gov/vuln/detail/CVE-2026-43883","https://github.com/WWBN/AVideo/commit/0da3dcff1eda2f497694bf82b559829471c292c2","https://github.com/WWBN/AVideo"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-958h-qp3x-q4gj","url":"https://osv.dev/vulnerability/GHSA-958h-qp3x-q4gj"}],"summary":"AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements"}