CVE-2026-12123 PUBLISHED

All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter

Assigner: Wordfence
Reserved: 12.06.2026 Published: 10.07.2026 Updated: 10.07.2026

The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. A Subscriber-level attacker can plant an internal or loopback URL in the mp4 post meta of a newly created aiovg_videos post via XML-RPC wp.newPost, then trigger the unauthenticated ?vdl=<post_id> endpoint to force the server to fetch that URL and stream the full response body back to the requester.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS Score: 6.4

Product Status

Vendor plugins360
Product All-in-One Video Gallery
Versions Default: unaffected
  • affected from 0 to 4.8.5 (incl.)

Credits

  • KoreaInfoSec finder

References

Problem Types

  • CWE-918 Server-Side Request Forgery (SSRF) CWE