CVE-2026-19075
Received Received - Intake

All-in-One Video Gallery File Download Vulnerability

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-19075
EUVD
EUVD-2026-54999

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
all-in-one_video_gallery all-in-one_video_gallery to 4.9.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19075 is a Server-Side Request Forgery (SSRF) vulnerability in the All-in-One Video Gallery WordPress plugin before version 4.9.2. It allows attackers with Subscriber-level access or higher to bypass security checks and access internal services by exploiting flaws in the plugin's host allowlist and DNS rebinding protection.

Detection Guidance

Check if the All-in-One Video Gallery plugin is installed and verify its version. If it is below 4.9.2, the system is vulnerable. Look for unusual network requests to internal services or unexpected file downloads via the 'vdl' parameter in URLs.

Impact Analysis

This vulnerability can expose sensitive internal data by allowing attackers to access internal services like admin panels, APIs, or cloud metadata endpoints. Attackers can read HTTP response bodies from these services, potentially leaking confidential information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive personal or health data. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. A breach via this vulnerability may result in regulatory penalties.

Mitigation Strategies

Update the All-in-One Video Gallery plugin to version 4.9.2 or later immediately. If updating is not possible, consider disabling the plugin until a patch is applied. Review user roles to ensure only trusted users have Subscriber-level access or higher.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19075. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart