CVE-2026-12123
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The All-in-One Video Gallery plugin for WordPress up to version 4.8.5 is vulnerable to Server-Side Request Forgery (SSRF) via the 'vdl' parameter. An authenticated attacker with subscriber-level access can make arbitrary web requests from the server, including to internal services, and read their responses.
Risk Assessment
An attacker can exploit this to scan internal networks, read sensitive data from internal services (e.g., cloud metadata), or modify internal system state, potentially leading to data breaches or privilege escalation.
Recommendation
Immediately update the All-in-One Video Gallery plugin to the latest available version that fixes this vulnerability. Until updated, restrict access to the '?vdl=' endpoint for untrusted users.
Other vulnerabilities in All-in-One Video Gallery
See all- CVE-2026-118629Medium
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page. This allows unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
- CVE-2026-114693Medium
The WordPress plugin 'All-in-One Video Gallery' (versions up to 4.9.7) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. A malicious script stored in the database executes for users visiting the site.
- CVE-2026-19075Medium
The All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post. It reads the post's `mp4` meta value and streams that URL's response back to the requester.
Original NVD description (English source)
The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. A Subscriber-level attacker can plant an internal or loopback URL in the `mp4` post meta of a newly created `aiovg_videos` post via XML-RPC `wp.newPost`, then trigger the unauthenticated `?vdl=<post_id>` endpoint to force the server to fetch that URL and stream the full response body back to the requester.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS