CVE-2025-15516: 
WordPress vulnerability analysis and mitigation

CVE-2025-15516 is a Missing Authorization vulnerability in the All-in-One Video Gallery plugin for WordPress, affecting versions 4.1.0 through 4.6.4. The flaw exists in the ajax_callback_store_user_meta() function, which lacks a proper capability check, allowing authenticated attackers with Subscriber-level access or higher to modify arbitrary string-based user meta keys on their own account. It was published on January 24, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence).

The root cause is classified as CWE-862 (Missing Authorization): the ajax_callback_store_user_meta() function in the plugin's admin handler (admin/admin.php, line 1062) does not verify whether the calling user has the appropriate capability before processing the request. An authenticated attacker with at minimum Subscriber-level access can send a crafted AJAX request to this function to overwrite arbitrary string-based user meta keys associated with their own WordPress account. No special configuration or elevated privileges beyond a basic authenticated session are required to exploit this vulnerability (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to modify arbitrary string-based user meta values for their own WordPress account without authorization. While the scope is limited to the attacker's own account and there is no direct confidentiality or availability impact, manipulation of user meta data could potentially be leveraged to alter plugin-specific settings, bypass access controls, or interfere with functionality that relies on user meta values. The integrity impact is rated low, and no lateral movement or data exfiltration is directly enabled by this vulnerability (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-15516. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a valid Subscriber-level account on the target WordPress site, limiting the attack surface to sites with open user registration or known credentials (Wordfence).

1. Reconnaissance: Identify WordPress sites running the All-in-One Video Gallery plugin in versions 4.1.0–4.6.4, using tools like WPScan or manual inspection of plugin version files.
2. Obtain authenticated access: Register or log in to the target WordPress site with at least a Subscriber-level account.
3. Craft malicious AJAX request: Send a POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the ajax_callback_store_user_meta() function, including the appropriate action parameter and the desired user meta key-value pair to be modified.
4. Modify user meta: The function, lacking a capability check, processes the request and updates the specified string-based user meta key for the attacker's account without authorization.
5. Leverage modified meta: Depending on how the plugin or other site components use the modified user meta, the attacker may be able to alter plugin behavior, bypass restrictions, or affect site functionality tied to that meta value (Wordfence, WordPress Trac).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php from low-privileged user accounts, particularly with action parameters associated with the All-in-One Video Gallery plugin's user meta storage function.
• Logs: WordPress access logs showing repeated AJAX calls to the ajax_callback_store_user_meta action from Subscriber-level accounts; unexpected changes to user meta values in the WordPress database for non-administrative users.
• Database: Unexpected or anomalous entries in the wp_usermeta table for Subscriber-level users, especially for meta keys related to the All-in-One Video Gallery plugin.

Users should update the All-in-One Video Gallery plugin to version 4.6.5 or later, which addresses the missing capability check in the ajax_callback_store_user_meta() function. If an immediate update is not possible, site administrators should consider disabling the plugin or restricting user registration to limit the pool of potential attackers. Monitoring AJAX requests for unusual activity from low-privileged accounts is also advisable as a compensating control (Wordfence).