# All-in-One Video Gallery <= 5.0.0 - Unauthenticated Server-Side Request Forgery via WordPress.com Video Source

- **ID:** WPSEC-2026-2447
- **Plugin:** All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos (`all-in-one-video-gallery`), https://wordpress.org/plugins/all-in-one-video-gallery/
- **Affected versions:** all versions before 5.1.0
- **Fixed in:** 5.1.0 (Update to 5.1.0 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-918
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/all-in-one-video-gallery
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2447/

## Description

The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery via the WordPress.com HLS source filter in all versions up to, and including, 5.0.0 due to the video source URL, which can be supplied through the player URL's query string, being validated only by a substring check for 'videos.files.wordpress.com' before being requested with wp_remote_get(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to probe internal services.

## References

- https://wpsec.com/vuln/WPSEC-2026-2447/
- https://plugins.svn.wordpress.org/all-in-one-video-gallery/tags/5.1.0/
- https://wordpress.org/plugins/all-in-one-video-gallery/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2447/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.