CVE-2026-19075 Overview
CVE-2026-19075 affects the All-in-One Video Gallery WordPress plugin. The plugin registers a public, unauthenticated file-download handler triggered by the ?vdl=<post_id> parameter on any aiovg_videos post. The handler resides in public/video.php within AIOVG_Public_Video::download_video(). The function reads the post's mp4 meta value and streams that URL's response back to the requester. This behavior enables Server-Side Request Forgery (SSRF) [CWE-918], allowing a low-privileged actor to coerce the server into fetching arbitrary URLs and returning the content to the client.
Critical Impact
An authenticated user with permission to create or edit aiovg_videos posts can force the server to issue outbound HTTP requests to attacker-chosen URLs and stream the responses back, exposing internal network resources.
Affected Products
- All-in-One Video Gallery WordPress plugin
- WordPress sites exposing the aiovg_videos post type
- Deployments where the plugin's public/video.php download handler is reachable
Discovery Timeline
- 2026-08-10 - CVE-2026-19075 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-19075
Vulnerability Analysis
The vulnerability originates in the AIOVG_Public_Video::download_video() method inside public/video.php. The plugin registers a global request handler that inspects incoming requests for the vdl query parameter. When present, the handler treats the value as a aiovg_videos post ID and retrieves the associated mp4 post meta field. The plugin then performs a server-side HTTP request to the URL stored in mp4 and pipes the response body directly to the requester.
The handler does not restrict the destination URL scheme or host. Because the mp4 meta value is writable by any user who can create or edit aiovg_videos posts, an attacker can set the value to an internal address such as http://127.0.0.1/, cloud metadata endpoints, or intranet services. The confidentiality impact is scoped as low because the server returns only the response body, and the CVSS scope change reflects data traversing trust boundaries between the WordPress instance and internal network destinations.
Root Cause
The root cause is missing validation of user-supplied URLs before performing a server-side fetch [CWE-918]. The download_video() function trusts the mp4 post meta value without checking scheme, host allowlists, or private IP ranges.
Attack Vector
An authenticated attacker with the ability to create or modify aiovg_videos posts sets the mp4 meta value to an internal or attacker-controlled URL. The attacker then issues an unauthenticated GET request to any public URL bearing the ?vdl=<post_id> parameter. The plugin's request handler resolves the post, reads the mp4 meta, and returns the fetched content to the caller. See the WPScan Vulnerability Advisory for additional technical details.
Detection Methods for CVE-2026-19075
Indicators of Compromise
- Unexpected HTTP requests in web server access logs containing the vdl query parameter, especially against aiovg_videos post URLs.
- Outbound requests from the WordPress host to internal IP ranges, localhost, or cloud metadata addresses such as 169.254.169.254.
- New or modified aiovg_videos posts with mp4 post meta values pointing to non-video URLs or internal hosts.
Detection Strategies
- Inspect WordPress database wp_postmeta records with meta_key = 'mp4' for URLs that do not match expected media file patterns.
- Alert on web application firewall events where vdl parameter values correlate with server-originated outbound connections.
- Correlate authenticated user activity that edits aiovg_videos posts with subsequent anonymous requests to ?vdl= endpoints.
Monitoring Recommendations
- Log and review outbound HTTP requests initiated by the PHP process, filtering for internal ranges (RFC 1918) and metadata endpoints.
- Enable WordPress audit logging for changes to the aiovg_videos post type and its meta fields.
- Monitor plugin version inventory to identify hosts running affected releases of All-in-One Video Gallery.
How to Mitigate CVE-2026-19075
Immediate Actions Required
- Update the All-in-One Video Gallery plugin to the fixed release referenced in the WPScan Vulnerability Advisory.
- Audit existing aiovg_videos posts and remove mp4 meta values pointing to internal hosts or non-media URLs.
- Restrict which WordPress roles can create or edit aiovg_videos posts to trusted users only.
Patch Information
Refer to the vendor advisory linked from the WPScan Vulnerability Advisory for the fixed plugin version. Apply the update through the WordPress plugin manager or by replacing the plugin files on disk.
Workarounds
- Block requests containing the vdl query parameter at the web application firewall until the plugin is patched.
- Deactivate the All-in-One Video Gallery plugin if the download feature is not required.
- Egress-filter the WordPress host so that PHP cannot reach internal network ranges or cloud metadata services.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
