What is the CVSS score of EUVD-2026-42828?

EUVD-2026-42828 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

All-in-One Video Gallery EUVD-2026-42828

| CVE-2026-12123 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-10 Wordfence

GHSA-5mf7-m64r-fr3h

WordPress SSRF Wordpress Plugin All In One Video Gallery Plugins360

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Subscriber-level setup step (PR:L) with unauthenticated SSRF trigger and scope change to internal network services (S:C) warrants network vector, changed scope, and low C/I impacts.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 06:51 vuln.today

CVE Published

Jul 10, 2026 - 05:34 cve.org

MEDIUM 6.4

DescriptionCVE.org

The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. A Subscriber-level attacker can plant an internal or loopback URL in the mp4 post meta of a newly created aiovg_videos post via XML-RPC wp.newPost, then trigger the unauthenticated ?vdl=<post_id> endpoint to force the server to fetch that URL and stream the full response body back to the requester.

AnalysisAI

Server-Side Request Forgery in the All-in-One Video Gallery WordPress plugin (all versions through 4.8.5) enables a two-stage attack where a subscriber-level authenticated user plants an internal or loopback URL into a video post's mp4 meta field via the XML-RPC wp.newPost method, then any unauthenticated party can trigger the ?vdl=<post_id> endpoint to force the server to fetch that URL and stream the full response body - enabling reconnaissance of internal services including cloud metadata endpoints. The CVSS scope change (S:C) captures the critical decoupling: subscriber-level credentials are needed only for setup, while the actual SSRF trigger requires no authentication at all. No public exploit identified at time of analysis, though the Wordfence advisory documents the complete attack chain with specific code line references.

Technical ContextAI

The affected product is the All-in-One Video Gallery WordPress plugin by plugins360 (CPE: cpe:2.3:a:plugins360:all-in-one_video_gallery:*:*:*:*:*:*:*:*), covering all versions through 4.8.5. The root cause is CWE-918 (Server-Side Request Forgery), where user-supplied URL values stored in the mp4 post meta field of an aiovg_videos post type are consumed by the server to make outbound HTTP requests without adequate allowlist validation or private-IP filtering. Vulnerable code paths are documented in public/video.php at lines L681, L724, L758, and L904, with the subscriber role permissions confirmed in includes/roles.php at line L70. The attack exploits two distinct WordPress interfaces: the XML-RPC endpoint (wp.newPost) to write the malicious URL into post metadata with subscriber credentials, and a separate unauthenticated video download handler (?vdl=<post_id>) that reads the stored URL and proxies the response to the caller - a classic stored-SSRF pattern where the poison is planted separately from the trigger.

RemediationAI

An upstream code fix has been committed to the WordPress plugin repository (changeset https://plugins.trac.wordpress.org/changeset/3582575); however, the specific patched release version number is not confirmed from available data - monitor the plugin's update channel in the WordPress dashboard and apply any version released after 4.8.5 as soon as it appears. As an immediate compensating control, disabling WordPress XML-RPC blocks the subscriber-level setup step entirely; add add_filter('xmlrpc_enabled', '__return_false'); to wp-config.php or use a security plugin such as Wordfence or Disable XML-RPC - note this will break legitimate XML-RPC consumers including the WordPress mobile app, Jetpack, and some backup plugins, so evaluate the trade-off. Blocking the ?vdl= query parameter via WAF rules on the frontend neutralizes the unauthenticated trigger step independently. At the network layer, restricting outbound HTTP/S connections from the web server to RFC-1918 address space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local ranges (169.254.0.0/16) prevents SSRF payloads from reaching internal services and cloud metadata endpoints even if the vulnerability remains unpatched - this is the highest-value compensating control for cloud-hosted environments. Additionally, if open subscriber registration is not required for site operation, disabling it via Settings > General removes the self-registration attack path.