EUVD-2026-54999
GHSA-65rp-7r2j-rmm6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
PR:L reflects requirement to control the mp4 meta field; S:C captures SSRF reaching systems beyond the WordPress boundary; C:L for partial internal data disclosure with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl=<post_id> on any aiovg_videos post (public/video.php, AIOVG_Public_Video::download_video()), which reads the post's mp4 meta value and streams that URL's response back to the requester.
AnalysisAI
Server-Side Request Forgery in the All-in-One Video Gallery WordPress plugin (all versions prior to 4.9.2) allows low-privileged WordPress users to weaponize the server as an HTTP proxy by abusing the public ?vdl=<post_id> download handler, which fetches and streams back the URL stored in a post's mp4 metadata field without destination validation. Attackers who can set that meta value can redirect server-side requests to internal network resources, cloud instance metadata endpoints, or RFC-1918 address space, with the full HTTP response returned to the attacker. No confirmed active exploitation (CISA KEV) at time of analysis, but a publicly available proof-of-concept exploit reported by WPScan exists; EPSS is low at 0.13% (3rd percentile), suggesting exploitation remains targeted rather than widespread.
Technical ContextAI
The vulnerability resides in the All-in-One Video Gallery WordPress plugin (PHP), specifically within public/video.php in the AIOVG_Public_Video::download_video() method. The root cause is CWE-918 (Server-Side Request Forgery): the method reads the mp4 custom post meta value - a user-controllable URL - and issues a server-side HTTP request to that destination, streaming the response body directly back to the HTTP client without validating that the target is an allowlisted or external-only resource. The handler is registered as a public WordPress endpoint (no WordPress session check), meaning any visitor can trigger the proxy behavior by supplying a valid aiovg_videos post ID. The affected CPE is cpe:2.3:a:unknown:all-in-one_video_gallery:*:*:*:*:*:*:*:* covering all versions below 4.9.2. The CVSS Scope:Changed metric correctly reflects that the WordPress process's outbound network stack is leveraged to reach systems beyond the application boundary, such as cloud metadata services and internal segment hosts.
RemediationAI
Upgrade the All-in-One Video Gallery WordPress plugin to version 4.9.2 or later, which contains the vendor-released patch. Updates are available via the standard WordPress plugin repository and the WPScan advisory at https://wpscan.com/vulnerability/ad70162f-5514-41b8-84af-c79c2f881567/. If immediate upgrade is not possible, apply the following compensating controls: first, restrict contributor and author role assignments to fully trusted accounts only, since meaningful SSRF exploitation requires a low-privileged WordPress account capable of editing the mp4 meta field; this does not eliminate the risk but removes opportunistic insider-level exploitation. Second, implement outbound egress filtering at the host or cloud security-group level to block WordPress server HTTP requests to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata addresses (169.254.169.254, 100.100.100.200 for Alibaba Cloud); this is the highest-value compensating control and prevents the SSRF from reaching high-value internal targets even if the plugin remains unpatched, though it may cause legitimate CDN or streaming integrations to fail if those endpoints fall within filtered ranges.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today