CVE-2026-12123

Name of the Vulnerable Software and Affected Versions All-in-One Video Gallery versions prior to 4.8.6

Description The All-in-One Video Gallery plugin for WordPress contains a Server-Side Request Forgery (SSRF) flaw. This issue allows authenticated users with subscriber-level access or higher to initiate web requests to arbitrary locations from the web application, potentially enabling the querying and modification of information from internal services. An attacker can achieve this by inserting an internal or loopback URL into the mp4 post meta of a new aiovg videos post using the XML-RPC wp.newPost function, and subsequently triggering the ?vdl= endpoint to force the server to fetch the URL and return the full response body.

Recommendations Update the plugin to a version newer than 4.8.5. As a temporary mitigation, restrict access to the ?vdl= endpoint or limit the use of the vdl parameter.