CVE-2026-19075: 
WordPress vulnerability analysis and mitigation

CVE-2026-19075 is a Server-Side Request Forgery (SSRF) vulnerability in the All-in-One Video Gallery WordPress plugin affecting versions prior to 4.9.2. The plugin registers a public, unauthenticated file-download handler triggered by the ?vdl=<post_id> parameter on any aiovg_videos post, which reads the post's mp4 meta value and streams that URL's response back to the requester. This CVE specifically documents two bypasses of the SSRF guard introduced in version 4.9.0 to fix the prior CVE-2026-12123. It was publicly disclosed on August 7–10, 2026, with a patch released in version 4.9.2. The CVSS v3.1 base score is 5.0 (Medium) per NVD, though the original researcher assessed it as approximately 7.1 (High) (WPScan, Github Advisory).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and stems from two independent bypasses of the aiovg_resolve_safe_url() guard function introduced in version 4.9.0. Bypass A (same-host allowlist ignores port): The aiovg_is_same_host_url() function compares only the hostname portion of a URL against the site's own host, ignoring the port number. An attacker can supply a URL using the site's own hostname on a different port (e.g., http://<site-host>:<internal-port>/) to bypass IP-range validation entirely, reaching internal services co-located on the same host. Bypass B (DNS rebinding / TOCTOU): The aiovg_resolve_safe_url() function resolves a hostname for validation via gethostbynamel()/dns_get_record(), then performs multiple separate DNS resolutions for subsequent get_headers() and fopen() calls without pinning to the validated IP. An attacker controlling a domain with a TTL=0 DNS record can return a safe public IP on the first (validation) query and a private/loopback IP on all subsequent fetches, bypassing the guard entirely. Exploitation of Bypass A or B requires a Subscriber-level WordPress account to plant the malicious URL in a video's mp4 post meta, since the plugin grants edit_aiovg_videos to the subscriber role by design; the ?vdl= download endpoint itself requires no authentication (WPScan).

Successful exploitation results in full HTTP response-body disclosure of whatever internal service answers at the attacker-chosen target — the actual content is streamed back verbatim in the download response, making this a non-blind SSRF. Repeated requests across ports also function as a reliable internal port scanner, with distinguishable responses for closed, open-but-empty, and content-serving ports. On cloud-hosted deployments, Bypass B can be directed at instance metadata services (e.g., 169.254.169.254) to attempt credential exfiltration, posing a significant risk of lateral movement or cloud account compromise (WPScan, Github Advisory).

There is no public proof-of-concept exploit available as of the disclosure date; WPScan indicated the PoC would be published on August 21, 2026, to allow time for patching. No in-the-wild exploitation has been observed, and the NVD SSVC assessment confirms exploitation status as "none." The EPSS score is approximately 0.13–0.16%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation does require a Subscriber-level WordPress account to set up the malicious mp4 meta value, which limits opportunistic mass exploitation (WPScan, Github Advisory).

1. Obtain Subscriber-level access: Register or compromise a Subscriber (or higher) account on the target WordPress site running All-in-One Video Gallery < 4.9.2, exploiting the plugin's default grant of edit_aiovg_videos to the subscriber role.
2. Create or edit an aiovg_videos post: Using the subscriber account, create or edit a video post and set the mp4 post meta value to a crafted URL targeting an internal resource.
   • For Bypass A: Use a URL with the site's own hostname but a different port, e.g., http://<site-hostname>:8080/admin to target an internal admin panel.
   • For Bypass B: Use a domain you control with a TTL=0 DNS record configured to return a safe public IP on the first query and a private/loopback IP (e.g., 169.254.169.254 or 192.168.x.x) on subsequent queries.
3. Trigger the download handler: As an unauthenticated user (or any user), send an HTTP GET request to https://<target-site>/?vdl=<post_id> where <post_id> is the ID of the crafted video post.
4. Receive internal service response: The plugin's AIOVG_Public_Video::download_video() function fetches the malicious URL and streams the full HTTP response body back to the requester, disclosing internal service content.
5. Port scan (optional): Repeat step 3 with different port numbers in the crafted URL to enumerate open internal ports based on distinguishable response differences (WPScan).

• Network: Unusual outbound HTTP requests from the WordPress server to internal IP ranges (RFC 1918: 10.x.x.x, 172.16-31.x.x, 192.168.x.x) or cloud metadata endpoints (169.254.169.254); DNS queries with TTL=0 records resolving to public IPs followed immediately by queries resolving to private IPs for the same hostname.
• Logs: WordPress/web server access logs showing repeated GET requests to /?vdl=<post_id> from varied source IPs, especially with sequential or enumerated post IDs; PHP error logs referencing AIOVG_Public_Video::download_video() or aiovg_resolve_safe_url() with unexpected hostnames.
• File System: No specific file artifacts expected, but review wp_postmeta database table for aiovg_videos posts with mp4 meta values pointing to internal IP addresses, loopback addresses, or suspicious external domains with TTL=0 DNS records.
• Process: Unexpected outbound connections from the PHP-FPM or web server process to non-standard ports on localhost or internal network hosts (WPScan).

Update the All-in-One Video Gallery plugin to version 4.9.2 or later, which addresses both SSRF bypass techniques identified in this report. As a temporary workaround, restrict access to the ?vdl= query parameter via web server rules (e.g., Nginx location blocks or Apache RewriteRule) or WAF policies to block unauthenticated download requests. Additionally, consider restricting Subscriber-level users from editing video post meta until patching is complete, and implement network-level egress filtering to block outbound requests from the web server to internal IP ranges and cloud metadata endpoints (WPScan, Github Advisory).

The vulnerability was discovered and reported by independent researcher Mohammed Abd Alrahman (mohmadev.com) and verified by WPScan. The disclosure notes that version 4.9.0 was released specifically to fix a prior SSRF (CVE-2026-12123) via the same vdl parameter, and this report identifies two live-confirmed bypasses of that fix, highlighting the challenge of correctly implementing SSRF mitigations. No broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (WPScan).