CVE-2025-12966 Overview
CVE-2025-12966 is an arbitrary file upload vulnerability in the All-in-One Video Gallery plugin for WordPress. The flaw affects versions 4.5.4 through 4.5.7 and stems from missing file type validation in the resolve_import_directory() function. Authenticated attackers with Author-level access or higher can upload arbitrary files to the server. Successful exploitation may lead to remote code execution on the affected WordPress site. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).
Critical Impact
Authenticated Author-level users can upload arbitrary files via the plugin's import functionality, potentially achieving remote code execution on the WordPress server.
Affected Products
- All-in-One Video Gallery plugin for WordPress version 4.5.4
- All-in-One Video Gallery plugin for WordPress version 4.5.5
- All-in-One Video Gallery plugin for WordPress versions 4.5.6 and 4.5.7
Discovery Timeline
- 2025-12-06 - CVE-2025-12966 published to the National Vulnerability Database
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-12966
Vulnerability Analysis
The vulnerability resides in the resolve_import_directory() function within the plugin's admin/import-export.php file. The function processes file uploads as part of the plugin's import functionality but fails to validate the type or extension of uploaded files. Attackers can therefore submit files with executable extensions such as .php rather than the expected media or archive formats.
Because the upload endpoint requires authentication, an attacker must first obtain credentials for an account with Author-level permissions or higher. Author accounts are common on multi-user WordPress sites, making this prerequisite achievable on many installations. Once uploaded, the malicious file can be requested directly through the web server, triggering execution within the PHP runtime.
Root Cause
The root cause is the absence of file type validation in resolve_import_directory(). The function accepts user-supplied input that determines the destination and content of an uploaded file without verifying that the file extension, MIME type, or magic bytes match an allow-list of safe formats. This omission maps directly to CWE-434.
Attack Vector
Exploitation requires network access to the WordPress admin interface and an authenticated session with Author privileges or higher. The attacker invokes the plugin's import functionality and supplies a crafted file payload. The resulting file is written to a web-accessible directory on the server. Requesting the file in a browser then executes the embedded code under the web server's privileges.
No verified exploit code is publicly available at this time. For technical context, refer to the WordPress Plugin Changeset and the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2025-12966
Indicators of Compromise
- Newly created PHP files within the plugin's upload or import directories, particularly under wp-content/uploads/ paths used by All-in-One Video Gallery.
- Unexpected HTTP POST requests from Author-level accounts to the plugin's import-export admin endpoint.
- Outbound network connections initiated by the PHP-FPM or web server process to unknown hosts shortly after import activity.
Detection Strategies
- Monitor WordPress audit logs for import actions performed by Author-level users who do not normally manage media imports.
- Inspect web server access logs for direct GET requests to files in plugin upload directories with executable extensions such as .php, .phtml, or .phar.
- Use file integrity monitoring to flag new or modified PHP files in wp-content/ directories outside of normal update windows.
Monitoring Recommendations
- Enable verbose logging on the WordPress admin endpoints and forward logs to a centralized SIEM for correlation.
- Alert on creation of executable file types within any directory writable by the web server user.
- Track unusual privilege usage patterns, such as Author accounts accessing plugin administration endpoints they have not previously used.
How to Mitigate CVE-2025-12966
Immediate Actions Required
- Update the All-in-One Video Gallery plugin to the patched version released after 4.5.7 as indicated in the WordPress Plugin Changeset.
- Audit existing Author-level and higher accounts and remove or reset credentials for any account that is unused or suspicious.
- Scan the WordPress installation for unexpected PHP files in upload directories and remove any unauthorized artifacts.
Patch Information
The plugin maintainers addressed the missing validation in changeset 3405593, which modifies admin/import-export.php to enforce file type restrictions within resolve_import_directory(). Site administrators should upgrade to the fixed release available through the WordPress plugin repository.
Workarounds
- Deactivate the All-in-One Video Gallery plugin until the patched version is installed.
- Restrict Author and higher role assignments to trusted users and require multi-factor authentication for all privileged WordPress accounts.
- Configure the web server to deny execution of PHP files within wp-content/uploads/ directories using rules in .htaccess or the equivalent Nginx configuration.
# Configuration example: block PHP execution in WordPress uploads (Apache .htaccess)
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
Require all denied
</FilesMatch>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
