All-in-One Video Gallery < 4.9.2 Unauthenticated SSRF (CVE-2026-19075)

Vulnerability Overview Vulnerability Name: All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdI' Parameter Vulnerability Type: SSRF (Server-Side Request Forgery) CVE ID: CVE-2026-19075 CVSS Score: 5.0 (medium) Description: All-in-One Video Gallery registers a public, unauthenticated download handler triggered by , which reads and streams the response from the URL. Although CVE-2026-12123 was fixed in version 4.9.0, two independent bypass methods exist. Impact Scope Affected Plugin: All-in-One Video Gallery Fixed Version: 4.9.2 Impact: Complete HTTP response body disclosure, regardless of how the service responds to the attacker-selected internal target. Repeated requests across ports can also serve as a reliable internal port scanner. Remediation Recommended Fix: In , compare the full authority (host and port), deriving the default port from the scheme. In , resolve the hostname to an IP once, validate the IP, and then connect to that specific IP for the actual request, rather than resolving the hostname independently in each subsequent step. Additional Information Original Researcher: Mohammed Abd Alrahman Submitter: Mohammed Abd Alrahman Submitter Website: https://mohmadev.com/ Verification Status: Yes WPVDB ID: ad70162f-5514-41b8-84af-c79c2f881567 Public Release Date: 2026-08-07 Added Date: 2026-08-07 Last Updated: 2026-08-07 References CVE-2026-19075: Link Classification Type: SSRF OWASP Top 10: A1: Injection CWE: CWE-918 CVSS: 5.0 (medium) Timeline Public Release: 2026-08-07 (approximately 3 days ago) Added: 2026-08-07 (approximately 2 days ago) Last Updated: 2026-08-07 (approximately 2 days ago) Other Related Vulnerabilities: - JetEngine < 3.8.12 - Authenticated (Contributor+) Sever-Side Request Forgery - Royal Addons for Elementor < 1.7.1058 - Contributor+ Server-Side Request Forgery via CSV URL Parameter - Auto Featured Image (Auto Post Thumbnail) < 5.0.5 - Authenticated (Contributor+) Server-Side Request Forgery - WordPress <= 4.4.2 - SSRF Bypass using Octal & Hexadecimal IP addresses - Pool Services <= 3.3 - Unauthenticated Server-Side Request Forgery Proof of Concept (POC) POC Code: No specific POC code is provided on the page, but it mentions that the POC will be demonstrated on August 21, 2026, to give users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

All-in-One Video Gallery < 4.9.2 Unauthenticated SSRF (CVE-2026-19075)