WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans.

Affected: Packagist: wwbn/avideo

## Summary

The PayPal IPN v1 handler at `plugin/PayPalYPT/ipn.php` lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer `ipnV2.php` and `webhook.php` handlers correctly deduplicate via `PayPalYPT_log` entries, but the v1 handler was never updated and remains actively referenced as the `notify_url` for billing plans.

## Details

When a recurring payment IPN arrives at `ipn.php`, the handler:

1. Verifies authenticity via `PayPalYPT::IPNcheck()` (line 16), which sends the POST data to PayPal's `cmd=_notify-validate` endpoint. PayPal confirms the data is genuine but this verification is **stateless** — PayPal returns `VERIFIED` for the same authentic data on every submission.

2. Looks up the subscription from `recurring_payment_id` and directly credits the user's wallet (lines 41-53):

```php // plugin/PayPalYPT/ipn.php lines 41-53 $row = Subscription::getFromAgreement($_POST["recurring_payment_id"]); $users_id = $row['users_id']; $payment_amount = empty($_POST['mc_gross']) ? $_POST['amount'] : $_POST['mc_gross']; $payment_currency = empty($_POST['mc_currency']) ? $_POST['currency_code'] : $_POST['mc_currency']; if ($walletObject->currency===$payment_currency) { $plugin->addBalance($users_id, $payment_amount, "Paypal recurrent", json_encode($_POST)); Subscription::renew($users_id, $row['subscriptions_plans_id']); $obj->error = false; } ```…