CVE-2024-31248: All-in-one Video Gallery Auth Bypass Flaw

CVE-2024-31248 Overview

CVE-2024-31248 is a Missing Authorization vulnerability [CWE-862] in the Plugins360 All-in-One Video Gallery plugin for WordPress. The flaw affects all versions up to and including 3.5.2. Authenticated attackers with low-level privileges can perform actions that should be restricted to higher-privileged roles. The vulnerability is remotely exploitable over the network and impacts confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact
An authenticated attacker with minimal privileges can bypass access controls in the All-in-One Video Gallery plugin, leading to unauthorized read and write operations on the WordPress installation.

Affected Products

Plugins360 All-in-One Video Gallery for WordPress (all versions through 3.5.2)
WordPress installations with the plugin activated
Any site relying on the plugin's default access control configuration

Discovery Timeline

2024-06-09 - CVE-2024-31248 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31248

Vulnerability Analysis

The vulnerability is a Broken Access Control issue in the All-in-One Video Gallery WordPress plugin. The plugin exposes functionality that lacks proper authorization checks before executing sensitive operations. An attacker holding a low-privileged authenticated account, such as Subscriber, can invoke plugin actions intended for administrators or editors. Successful exploitation impacts confidentiality, integrity, and availability of the target site.

Because the attack vector is network-based and complexity is low, exploitation does not require user interaction or elevated privileges beyond a basic authenticated session. Sites permitting open user registration face increased exposure.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862]. The plugin fails to validate that the requesting user possesses the required capability before executing a protected action. Standard WordPress authorization primitives such as current_user_can() capability checks and nonce validation are either absent or improperly enforced on affected endpoints. This omission allows any authenticated user to reach code paths reserved for privileged roles.

Attack Vector

An attacker authenticates to the WordPress site with any low-privilege account. The attacker then issues HTTP requests to plugin endpoints that lack proper capability checks. Because authorization is not enforced server-side, the plugin processes the request as if it originated from an authorized user. Refer to the Patchstack Vulnerability Report for endpoint-specific technical details.

Detection Methods for CVE-2024-31248

Indicators of Compromise

Unexpected modifications to video gallery entries, settings, or attached media by non-administrator accounts
WordPress audit log entries showing low-privilege users invoking plugin AJAX or REST endpoints
New or altered WordPress user accounts, posts, or uploaded files coinciding with plugin activity
HTTP POST requests to admin-ajax.php or plugin REST routes from Subscriber-level session cookies

Detection Strategies

Inventory WordPress installations and identify sites running All-in-One Video Gallery versions at or below 3.5.2
Enable a WordPress activity/audit logging plugin to record capability-gated actions with the invoking user role
Review web server access logs for authenticated requests to plugin endpoints originating from low-privilege sessions

Monitoring Recommendations

Alert on anomalous administrative actions performed by non-administrator user roles
Monitor for spikes in requests to admin-ajax.php referencing aiovg_ action parameters
Track file uploads and post modifications tied to plugin activity for correlation with session role

How to Mitigate CVE-2024-31248

Immediate Actions Required

Update All-in-One Video Gallery to a version later than 3.5.2 that addresses the Missing Authorization flaw
Audit existing WordPress user accounts and remove untrusted or dormant low-privilege accounts
Disable open user registration if it is not required for site operations
Review recent plugin-related activity for signs of unauthorized use

Patch Information

The vendor released a fixed version of the plugin. Consult the Patchstack Vulnerability Report for the exact fixed version and upgrade guidance. Apply the update through the WordPress plugin manager or by replacing plugin files from the official repository.

Workarounds

Deactivate and remove the All-in-One Video Gallery plugin until an updated version can be deployed
Restrict access to /wp-admin/admin-ajax.php and plugin REST routes at the web application firewall (WAF) layer for non-administrator sessions
Apply the principle of least privilege by downgrading unnecessary user roles

bash

# Configuration example: WP-CLI commands to inventory and update the plugin
wp plugin list --name=all-in-one-video-gallery --fields=name,status,version
wp plugin update all-in-one-video-gallery
wp plugin deactivate all-in-one-video-gallery   # if update is not yet available