All-in-One Video Gallery CVE-2026-12123

Two sequential conditions must be met. First, the attacker must obtain at minimum a WordPress subscriber account on the target site - sites with open user registration (Settings > General > Anyone can register) allow self-registration, effectively reducing the authentication bar to none. With this account, the attacker calls the XML-RPC wp.newPost API (active by default in all WordPress installations) to create an aiovg_videos post type with an arbitrary URL in the mp4 post meta field. Second, the ?vdl=<post_id> endpoint must be publicly reachable (no authentication required for this step per the description), which is the default state. Limiting factors: subscriber registration must be available for external attackers without existing credentials; the XML-RPC interface must be active (WordPress default, but commonly disabled by hardening guides); the All-in-One Video Gallery plugin must be installed and active in a version at or below 4.8.5; and the web server must have outbound network access to the SSRF target (internal services, loopback, or cloud metadata addresses). Sites that have already disabled XML-RPC or restricted outbound egress are not exploitable via the documented attack chain.

The NVD CVSS 3.1 score of 6.4 (Medium) reflects network accessibility, low complexity, subscriber-level privilege, scope change, and limited C/I impacts - consistent with SSRF to internal services rather than direct code execution. The scope change metric (S:C) is the most significant signal: the unauthenticated trigger step means any internet-exposed WordPress site accepting subscriber registrations is exploitable by an external attacker who self-registers, lowering the effective privilege bar closer to PR:N for sites with open registration. EPSS data was not provided in available intelligence and cannot be estimated. This CVE is not in CISA KEV, confirming no verified mass exploitation at time of analysis. The real-world priority is highest for: cloud-hosted WordPress sites (AWS IMDSv1 metadata exposure is a known high-value SSRF target), sites with open subscriber registration, and sites with accessible internal APIs or administrative interfaces reachable from the web server. The integrity impact (I:L) reflects the ability to send authenticated requests to internal services that may interpret GET parameters as write operations. CVSS C:L and I:L may understate risk in cloud environments where SSRF-to-metadata can yield IAM credential theft and account takeover.

An external attacker self-registers as a WordPress subscriber on a target site running All-in-One Video Gallery 4.8.5 with open user registration enabled, then submits an XML-RPC wp.newPost call creating an aiovg_videos post with the mp4 meta field set to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1 credential endpoint). The attacker then sends an unauthenticated GET request to /?vdl=<post_id> from any IP and receives the streaming response body containing cloud IAM role credentials, enabling full AWS account access. No public exploit code has been identified, but the Wordfence advisory references exact source lines sufficient to reproduce the attack chain.