CVE-2026-19075: 
WordPress 취약성 분석 및 완화

CVE-2026-19075 is a Server-Side Request Forgery (SSRF) vulnerability in the All-in-One Video Gallery WordPress plugin that allows authenticated Subscriber-level users to bypass internal network protections and access internal services. The vulnerability affects all versions prior to 4.9.2 and was publicly disclosed on August 7, 2026, with the patch released on August 10, 2026. It is classified as CWE-918 (SSRF) with a CVSS 3.1 score of approximately 7.1 (High) per WPScan, though the GitHub Advisory Database lists severity as unknown (WPScan, GitHub Advisory).

The root cause is an incomplete fix for a prior SSRF vulnerability (CVE-2026-12123) in the plugin's public/video.php file, specifically the AIOVG_Public_Video::download_video() method, which reads a post's mp4 meta value and streams the URL's HTTP response back to the requester. Version 4.9.0 introduced aiovg_resolve_safe_url() with a private/reserved-IP-range check, but two independent bypasses remain. Bypass A (same-host allowlist ignores port): aiovg_is_same_host_url() compares only the hostname (not the port) against the site's own host, so a URL like http://<site-host>:<internal-port>/ is treated as fully trusted and bypasses all IP validation. Bypass B (DNS rebinding / TOCTOU): The function resolves a hostname for validation via gethostbynamel()/dns_get_record(), then re-resolves the same hostname string independently for each subsequent get_headers() and fopen() call without pinning to the validated IP — a classic time-of-check/time-of-use race exploitable via a TTL=0 DNS record that returns a public IP on the first query and a private/loopback IP on all subsequent queries. Exploitation requires a Subscriber-level account to plant the malicious URL in a video's mp4 post meta, since the plugin grants edit_aiovg_videos to the subscriber role by design; the ?vdl=<post_id> trigger endpoint itself requires no authentication (WPScan).

Successful exploitation results in full HTTP response-body disclosure of whatever internal service answers at the attacker-chosen target — the actual content is streamed back verbatim, making this a non-blind SSRF. Repeated requests across ports also function as a reliable internal port scanner, with distinguishable responses for closed, open-but-invalid, and open-with-content ports. On cloud-hosted deployments, Bypass B can be directed at the instance metadata service (169.254.169.254) to attempt credential exfiltration, since it does not require any relationship to the site's own hostname (WPScan).

There is no public proof-of-concept available at the time of disclosure; WPScan has indicated the PoC will be published on August 21, 2026, to allow time for patching. There is no evidence of in-the-wild exploitation, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a Subscriber-level WordPress account, which limits opportunistic mass exploitation but remains a realistic threat on sites with open registration (WPScan, GitHub Advisory).

1. Obtain Subscriber access: Register or obtain a Subscriber-level (or higher) account on the target WordPress site running All-in-One Video Gallery < 4.9.2, exploiting open registration if available.
2. Create or edit an aiovg_videos post: Use the Subscriber account's edit_aiovg_videos capability to create or modify a video post, setting the mp4 post meta value to a malicious internal URL (e.g., http://<site-host>:<internal-port>/ for Bypass A, or a controlled domain with a TTL=0 DNS record for Bypass B).
3. Bypass A — same-host port abuse: Set the mp4 meta to http://<site-hostname>:8080/admin (or any internal port). The aiovg_is_same_host_url() check matches the hostname and skips IP validation entirely, allowing the request to reach the internal service.
4. Bypass B — DNS rebinding: Point a controlled domain's DNS to a public IP (TTL=0). On the first resolution (validation), the public IP is returned and passes the safe-IP check. On subsequent resolutions (actual fetch calls), return a private/loopback IP (e.g., 169.254.169.254). Set the mp4 meta to this controlled domain URL.
5. Trigger the download handler: As an unauthenticated user (or any user), send an HTTP GET request to https://<target-site>/?vdl=<post_id> where <post_id> is the ID of the modified video post.
6. Receive internal response: The plugin streams the full HTTP response body of the internal service back in the download response, disclosing sensitive content such as admin panels, internal APIs, or cloud metadata credentials (WPScan).

• Network: Unusual outbound HTTP requests from the WordPress server to internal IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x, 127.x.x.x, 169.254.169.254) or to non-standard ports on the server's own hostname; repeated DNS queries for the same external hostname with very short TTLs from the web server process.
• Logs: WordPress/web server access logs showing repeated GET requests to /?vdl=<post_id> from varied source IPs, especially if the post ID corresponds to a recently modified video post; PHP error logs showing get_headers() or fopen() calls to internal addresses.
• File System / Database: aiovg_videos post meta entries where the mp4 field contains internal IP addresses, loopback addresses, cloud metadata endpoints (e.g., 169.254.169.254), or the site's own hostname with non-standard ports.
• Process: Web server worker processes (e.g., php-fpm, apache2) initiating outbound TCP connections to internal services or metadata endpoints that would not normally be accessed by the web application (WPScan).

Update the All-in-One Video Gallery plugin to version 4.9.2 or later, which addresses both SSRF bypass vectors identified in this report. As a temporary workaround, restrict access to the ?vdl= query parameter via web server rules (e.g., nginx location blocks or Apache RewriteRule) or WAF policies to block unauthenticated or unauthorized access to the download handler. Additionally, consider restricting WordPress subscriber registration if open registration is not required, and audit existing aiovg_videos post meta for suspicious mp4 values pointing to internal addresses (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by independent researcher Mohammed Abd Alrahman (mohmadev.com) and verified by WPScan. The disclosure notes that version 4.9.0 was released specifically to fix the prior SSRF (CVE-2026-12123) via the same parameter, making this a bypass of an incomplete patch — a pattern that often draws community attention to the adequacy of vendor security reviews. No significant broader media coverage or social media discussion has been identified at this time (WPScan).