CVE-2025-15516: WordPress Video Gallery Auth Bypass Flaw

CVE-2025-15516 Overview

The All-in-One Video Gallery plugin for WordPress contains a broken access control vulnerability (CWE-862) due to a missing capability check on the ajax_callback_store_user_meta() function. This flaw allows authenticated attackers with Subscriber-level access or above to modify arbitrary string-based user meta keys for their own account without proper authorization.

Critical Impact

Authenticated attackers with minimal privileges (Subscriber-level) can exploit this missing authorization vulnerability to update user meta values, potentially leading to privilege escalation or manipulation of user account settings.

Affected Products

• All-in-One Video Gallery plugin for WordPress versions 4.1.0 to 4.6.4

Discovery Timeline

• 2026-01-24 - CVE CVE-2025-15516 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-15516

Vulnerability Analysis

This vulnerability stems from a missing capability check in the ajax_callback_store_user_meta() function within the All-in-One Video Gallery plugin. The function processes AJAX requests to store user metadata but fails to verify whether the requesting user has appropriate permissions to perform the action. This authorization bypass allows any authenticated user, including those with the lowest privilege level (Subscriber), to manipulate user meta fields.

The vulnerability is classified under CWE-862 (Missing Authorization), which indicates that the software does not perform an authorization check when an actor attempts to access a resource or perform an action. In WordPress environments, proper capability checks using functions like current_user_can() are essential to prevent unauthorized data modifications.

Root Cause

The root cause is the absence of a proper capability check in the ajax_callback_store_user_meta() function located in the plugin's admin handler. WordPress plugins should verify user capabilities before processing sensitive operations. The vulnerable function accepts and processes user meta update requests without validating whether the authenticated user has sufficient permissions to modify the specified meta keys.

The vulnerable code can be reviewed in the WordPress Plugin Code Review.

Attack Vector

The attack is network-based and requires low-privilege authentication. An attacker needs only a valid Subscriber account to exploit this vulnerability. The exploitation flow involves:

1. Authenticating to the WordPress site with a Subscriber-level account
2. Crafting a malicious AJAX request targeting the ajax_callback_store_user_meta() endpoint
3. Submitting arbitrary user meta key-value pairs to modify account settings
4. The server processes the request without verifying the user's capability to perform such modifications

The vulnerability is exploitable through crafted AJAX POST requests to the WordPress admin-ajax.php endpoint, targeting the vulnerable callback function. Since the function only allows modification of the attacker's own user meta (not other users'), the impact is limited to self-account manipulation. However, depending on which meta keys are used by other plugins or the theme, this could lead to privilege escalation or bypassing security restrictions.

Detection Methods for CVE-2025-15516

Indicators of Compromise

• Unusual AJAX requests to admin-ajax.php with actions related to the All-in-One Video Gallery plugin
• Unexpected modifications to user meta values in the WordPress database
• Subscriber-level accounts exhibiting elevated permissions or modified account settings
• Anomalous activity patterns from low-privilege user accounts

Detection Strategies

• Monitor WordPress AJAX endpoints for requests targeting ajax_callback_store_user_meta from low-privilege accounts
• Implement logging for all user meta modifications and alert on changes from Subscriber-level accounts
• Review wp_usermeta table for unexpected or suspicious meta key modifications
• Deploy Web Application Firewall (WAF) rules to detect and block suspicious AJAX request patterns

Monitoring Recommendations

• Enable comprehensive WordPress activity logging using security plugins
• Set up alerts for user meta changes originating from non-administrative accounts
• Periodically audit user meta values for anomalies or unauthorized modifications
• Monitor for reconnaissance activity against WordPress plugin endpoints

How to Mitigate CVE-2025-15516

Immediate Actions Required

• Update the All-in-One Video Gallery plugin to a version newer than 4.6.4 that includes the security fix
• Audit user meta values for all accounts to identify any unauthorized modifications
• Review user accounts for unexpected privilege levels or capabilities
• Consider temporarily deactivating the plugin until patched if an update is not immediately available

Patch Information

A patched version addressing this missing authorization vulnerability should be available through the WordPress plugin repository. Site administrators should update immediately by navigating to the WordPress admin dashboard under Plugins > Installed Plugins and updating the All-in-One Video Gallery plugin. For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict user registration to prevent unauthorized Subscriber accounts from being created
• Implement additional access controls at the web server or WAF level to filter malicious AJAX requests
• Use a WordPress security plugin to add capability checks and monitor for suspicious activity
• Consider disabling the affected AJAX callback functionality if not required for site operations

# Configuration example - Restrict access to AJAX endpoint via .htaccess
# Add to WordPress root .htaccess to log suspicious admin-ajax.php requests
<Files admin-ajax.php>
    # Enable logging for security monitoring
    SetEnvIf Request_Method POST log_ajax_post
    CustomLog /var/log/wordpress/ajax_requests.log combined env=log_ajax_post
</Files>