CVE-2026-19075 in All-in-One Video Gallery Plugin
Summary
by MITRE • 08/10/2026
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical access control flaw that enables unauthorized file downloads through a public endpoint in the All-in-One Video Gallery WordPress plugin. The security issue stems from the implementation of a file download handler that operates without proper authentication or authorization checks, making it accessible to any attacker who can guess or discover valid post IDs. The vulnerable code path begins with the URL parameter `?vdl=<post_id>` which triggers the `AIOVG_Public_Video::download_video()` method in `public/video.php`. This handler directly reads the post's meta value containing an mp4 file path and streams that content back to the requester without verifying whether the user has proper permissions or if the requested resource should be accessible.
The technical implementation of this vulnerability follows a classic pattern of insecure direct object reference where the application accepts user-supplied identifiers without proper validation or access control mechanisms. The handler performs no checks against user authentication status, role-based permissions, or content ownership, meaning that any authenticated or unauthenticated user can potentially download videos that are intended to be restricted. This flaw essentially creates a public gateway to media files that should typically be protected behind access controls or require specific authorization to retrieve.
The operational impact of this vulnerability extends beyond simple information disclosure as it can lead to unauthorized access to copyrighted content, private media files, and potentially sensitive data stored within the WordPress environment. Attackers could systematically enumerate post IDs to discover and download all available video content, including media that may contain confidential information or be subject to copyright restrictions. The vulnerability also enables potential denial-of-service scenarios where attackers could overwhelm the system with download requests for large video files, consuming bandwidth and server resources. This type of flaw commonly maps to CWE-284: Improper Access Control within the Common Weakness Enumeration framework, representing a fundamental failure in access control implementation.
From an attack perspective, this vulnerability aligns with multiple techniques described in the MITRE ATT&CK framework under the initial access and privilege escalation domains. The unauthenticated file download capability provides attackers with a straightforward method for information gathering and content theft, potentially serving as a stepping stone for further exploitation of the WordPress installation or underlying infrastructure. Security professionals should consider implementing immediate mitigations including disabling the vulnerable endpoint, adding authentication requirements, or restricting access through firewall rules. The recommended remediation approach involves implementing proper access controls that verify user permissions before allowing file downloads, ensuring that only authorized individuals can access protected media content. Additionally, input validation and sanitization should be implemented to prevent parameter manipulation attacks that could exploit the vulnerable post ID handling mechanism.