CVE-2026-12123
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The All-in-One Video Gallery plugin for WordPress up to version 4.8.5 is vulnerable to Server-Side Request Forgery (SSRF) via the 'vdl' parameter. An authenticated attacker with subscriber-level access can make arbitrary web requests from the server, including to internal services, and read their responses.
Risk Assessment
An attacker can exploit this to scan internal networks, read sensitive data from internal services (e.g., cloud metadata), or modify internal system state, potentially leading to data breaches or privilege escalation.
Recommendation
Immediately update the All-in-One Video Gallery plugin to the latest available version that fixes this vulnerability. Until updated, restrict access to the '?vdl=' endpoint for untrusted users.
Other vulnerabilities in All-in-One Video Gallery
Original NVD description (English source)
The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. A Subscriber-level attacker can plant an internal or loopback URL in the `mp4` post meta of a newly created `aiovg_videos` post via XML-RPC `wp.newPost`, then trigger the unauthenticated `?vdl=<post_id>` endpoint to force the server to fetch that URL and stream the full response body back to the requester.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS