CVE-2025-12957
BaseFortify
Publication date: 2026-01-16
Last updated on: 2026-01-16
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp_media | all-in-one-video-gallery | to 4.5.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the All-in-One Video Gallery WordPress plugin (up to version 4.5.7) and allows authenticated users with author-level access or higher to upload arbitrary files to the server. The issue arises because the plugin insufficiently validates file types, specifically allowing files with double extensions to bypass sanitization by being accepted as valid VTT files. This can lead to attackers uploading malicious files that may enable remote code execution on the affected site. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with author-level access or above to upload arbitrary files, potentially including malicious scripts, to the server hosting the WordPress site. This can lead to remote code execution, compromising the server, stealing data, defacing the website, or using the server as a launch point for further attacks. [1]
What immediate steps should I take to mitigate this vulnerability?
Update the All-in-One Video Gallery WordPress plugin to version 4.6.4 or later, which includes a comprehensive security patch addressing CVE-2025-12957. This update modifies core plugin PHP files, admin interface scripts, public-facing assets, and other components to fix the arbitrary file upload vulnerability. Ensuring the plugin is updated will mitigate the risk of authenticated attackers uploading arbitrary files and potentially executing remote code. [1]