All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter

Summary

CVE	CVE-2026-12123
State	PUBLISHED
Assigner	Wordfence
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-07-10 07:16:27 UTC
Updated	2026-07-10 15:43:30 UTC
Description	The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. A Subscriber-level attacker can plant an internal or loopback URL in the `mp4` post meta of a newly created `aiovg_videos` post via XML-RPC `wp.newPost`, then trigger the unauthenticated `?vdl=<post_id>` endpoint to force the server to fetch that URL and stream the full response body back to the requester.

Risk And Classification

Primary CVSS: v3.1 6.4 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.002460000 probability, percentile 0.156800000 (date 2026-07-13)

Problem Types: CWE-918 | CWE-918 CWE-918 Server-Side Request Forgery (SSRF)

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	6.4	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N`
3.1	CNA	DECLARED	6.4	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Plugins360	All-in-One Video Gallery	affected 4.8.5 semver	Not specified

References

Reference	Source	Link	Tags
plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.8.5/includes/roles.php	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/changeset/3582575	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.5/public/video.php	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.8.5/public/video.php	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.5/public/video.php	[email protected]	plugins.trac.wordpress.org
www.wordfence.com/threat-intel/vulnerabilities/id/a3bb454c-ac0e-4915-8c6e-07059...	[email protected]	www.wordfence.com
plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.8.5/public/video.php	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.5/public/video.php	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.8.5/public/video.php	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.8.5/public/video.php	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.5/includes/roles.php	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.5/public/video.php	[email protected]	plugins.trac.wordpress.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: KoreaInfoSec (en)

Additional Advisory Data

Source	Time	Event
CNA	2026-06-12T15:26:40.000Z	Vendor Notified
CNA	2026-07-09T16:59:54.000Z	Disclosed

There are currently no legacy QID mappings associated with this CVE.