CVE-2026-12123: All-in-One Video Gallery SSRF Vulnerability in WordPress

Technical summary

The vulnerability exists in the `vdl` parameter of the All-in-One Video Gallery plugin's download functionality. The attack chain involves two steps: (1) A subscriber-level attacker uses XML-RPC's `wp.newPost` to create or modify an `aiovg_videos` post, injecting a malicious URL into the `mp4` post meta field; (2) The attacker then accesses the unauthenticated `?vdl=<post_id>` endpoint, which retrieves the URL from the post meta and makes a server-side request to it, returning the full response body to the requester. The lack of proper input validation and outbound request filtering allows the plugin to reach internal IP addresses, loopback interfaces, and services not exposed to the internet.

Business impact

Organizations using this plugin face exposure of internal services and data. An attacker can use the vulnerability to enumerate internal networks, access cloud metadata services (AWS, GCP, Azure), exfiltrate data from internal APIs, or interact with internal systems like databases and caching layers. Because the initial compromise only requires subscriber access—a role often granted to content creators—the barrier to exploitation is low, increasing organizational risk from insider threats and compromised user accounts.

Affected systems

All versions of the All-in-One Video Gallery plugin for WordPress up to and including version 4.8.5 are vulnerable. Any WordPress installation with this plugin installed and at least one user with subscriber-level or higher permissions is at risk. The vulnerability does not require the attacker to be an authenticated site administrator; subscriber accounts are sufficient.

Exploitability

Exploitability is moderate to high. The attack requires subscriber-level access, but WordPress sites frequently grant this role to content creators, freelancers, and contributors. Once a subscriber account is obtained—either through compromise, phishing, or legitimate access—exploitation is straightforward and requires no complex techniques. The unauthenticated download endpoint that triggers the SSRF can be accessed by any visitor to the site, amplifying risk if an attacker already controls a post on the site.

Remediation

Update the All-in-One Video Gallery plugin to a patched version released after 4.8.5. Verify the fix through the plugin's official repository or vendor advisory to confirm the version number. If an immediate patch is unavailable, temporarily disable the plugin or restrict XML-RPC access to trusted users only. Review user roles and revoke unnecessary subscriber access to limit the pool of potential attackers.

Patch guidance

Monitor the All-in-One Video Gallery plugin's official repository and vendor advisories for a security update addressing this SSRF vulnerability. Once available, apply the patch immediately to all affected WordPress installations. Before patching, consider temporarily deactivating the plugin to eliminate attack surface. Test the patched version in a staging environment to ensure compatibility with your theme and other plugins before deploying to production.

Detection guidance

Monitor web server logs for unusual patterns in the `vdl` parameter, particularly requests containing localhost, 127.0.0.1, internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or cloud metadata endpoints (169.254.169.254). Watch for XML-RPC `wp.newPost` calls from subscriber-level accounts, especially those creating or modifying `aiovg_videos` posts with suspicious `mp4` meta values. Review access logs for the unauthenticated download endpoint immediately following such posts. Implement Web Application Firewall rules to block outbound requests to private IP ranges originating from the plugin.

Why prioritize this

Although the CVSS score is 6.4 (Medium), the practical risk is elevated because the vulnerability requires only subscriber-level access, a role widely distributed across WordPress sites. The ability to reach internal systems and services, combined with the low barrier to exploitation, makes this a priority fix for organizations running WordPress with this plugin. Ransomware and data exfiltration campaigns increasingly leverage SSRF vulnerabilities to move laterally into internal networks.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects a network-accessible vulnerability requiring low privileges (subscriber access) with no user interaction, affecting confidentiality and integrity but not availability. The score is appropriate for the technical severity, but operational risk is higher due to the prevalence of subscriber accounts on typical WordPress sites and the value of internal network access to attackers.

Frequently asked questions