All-in-One Video Gallery EUVD-2026-54999

Exploitation requires a low-privileged WordPress account with post-editing capabilities on aiovg_videos posts, specifically the ability to write the mp4 custom meta field; this corresponds to the contributor or author role in a default WordPress configuration. The All-in-One Video Gallery plugin must be installed, active, and at a version below 4.9.2. Once the mp4 meta field is set to a chosen internal URL, triggering the SSRF via the ?vdl= handler requires no authentication - any HTTP client can issue the request. Impact is highest when the WordPress server has network egress to cloud instance metadata services, internal APIs, or non-internet-facing hosts. Exploitation is bounded by the prerequisite of a WordPress account with post-editing rights; unauthenticated internet-scanning bots cannot exploit this without that prerequisite, which limits exposure primarily to insider threats, compromised low-privilege accounts, or targeted attacks against specific WordPress installations.

Real-world risk is moderate and environment-dependent. The CVSS score of 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) captures a network-accessible, low-complexity SSRF with limited confidentiality impact and no integrity or availability effects. EPSS at 0.13% (3rd percentile) indicates the vulnerability is not being broadly automated by attackers. The absence of a CISA KEV listing corroborates this, though it should not be treated as confirmation of safety given the short post-disclosure window. The publicly available WPScan proof-of-concept meaningfully elevates risk beyond what EPSS alone suggests, particularly for environments where the WordPress server has egress access to cloud metadata or internal APIs. The most dangerous deployments are cloud-hosted WordPress sites on AWS, GCP, or Azure where a successful SSRF to the instance metadata service could yield IAM credentials, enabling lateral movement. One discrepancy requires flagging: the CVE description characterizes the ?vdl= handler as 'public, unauthenticated,' yet the provided CVSS vector assigns PR:L - this is best reconciled by understanding that while triggering the proxy request itself is unauthenticated, exploiting the SSRF against a chosen internal target requires prior write access to set the mp4 meta field, which is a low-privileged WordPress capability.

An attacker who has obtained a contributor or author WordPress account edits an aiovg_videos post and sets its mp4 metadata field to an internal target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ on an AWS-hosted site. The attacker then sends an unauthenticated GET request to the public handler with the parameter ?vdl=<post_id>, causing the WordPress server to fetch the instance metadata endpoint and stream the full IAM credential response - including access keys and session tokens - back to the attacker's browser. A publicly available proof-of-concept exploit for this vector has been published by WPScan, reducing the skill bar for this attack pattern.