CVE-2026-19075

Deferred Deferred - Pending Action

All-in-One Video Gallery File Download Vulnerability

Publication date: 2026-08-10

Last updated on: 2026-08-26

Assigner: WPScan

Description

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-26

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-19075

EUVD

EUVD-2026-54999

Affected Vendors & Products

Vendor	Product	Version / Range
all-in-one_video_gallery	all-in-one_video_gallery	to 4.9.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-19075 is a Server-Side Request Forgery (SSRF) vulnerability in the All-in-One Video Gallery WordPress plugin before version 4.9.2. It allows attackers with Subscriber-level access or higher to bypass security checks and access internal services by exploiting flaws in the plugin's host allowlist and DNS rebinding protection.

Detection Guidance

Check if the All-in-One Video Gallery plugin is installed and verify its version. If it is below 4.9.2, the system is vulnerable. Look for unusual network requests to internal services or unexpected file downloads via the 'vdl' parameter in URLs.

Impact Analysis

This vulnerability can expose sensitive internal data by allowing attackers to access internal services like admin panels, APIs, or cloud metadata endpoints. Attackers can read HTTP response bodies from these services, potentially leaking confidential information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive personal or health data. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. A breach via this vulnerability may result in regulatory penalties.

Mitigation Strategies

Update the All-in-One Video Gallery plugin to version 4.9.2 or later immediately. If updating is not possible, consider disabling the plugin until a patch is applied. Review user roles to ensure only trusted users have Subscriber-level access or higher.

Hi! I’m here to help you understand CVE-2026-19075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70