Vulnerabilities / All-in-One Video Gallery / WPSEC-2026-2447
All-in-One Video Gallery <= 5.0.0 - Unauthenticated Server-Side Request Forgery via WordPress.com Video Source
High 7.2
CWE-918Fixed in 5.1.0
- ID
- WPSEC-2026-2447
- Plugin
- All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos (all-in-one-video-gallery)
- Affected
- all versions before 5.1.0
- Remediation
- Update to 5.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-918
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- All-in-One Video Gallery on WPSec AttackSurface
- Fix released
- Published
Description
The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery via the WordPress.com HLS source filter in all versions up to, and including, 5.0.0 due to the video source URL, which can be supplied through the player URL's query string, being validated only by a substring check for 'videos.files.wordpress.com' before being requested with wp_remote_get(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to probe internal services.
References
- https://wpsec.com/vuln/WPSEC-2026-2447/
- https://plugins.svn.wordpress.org/all-in-one-video-gallery/tags/5.1.0/
- https://wordpress.org/plugins/all-in-one-video-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS