PT-2026-3212 · WordPress · All-In-One Video Gallery

Michael Mazzolini · Publicado 2026-01-16 · Atualizado 2026-01-17 · CVE-2025-12957

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions All-in-One Video Gallery plugin for WordPress versions prior to 4.5.8

Description The All-in-One Video Gallery plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation when handling VTT files. This allows attackers to bypass sanitization by using double extension files, potentially leading to remote code execution. The issue affects authenticated attackers with author-level access or higher. The vulnerability stems from the plugin’s acceptance of files as valid VTT files without proper checks, enabling the upload of arbitrary files to the server.

Recommendations Update the All-in-One Video Gallery plugin to version 4.5.8 or later.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2025-12957

Produtos afetados

All-In-One Video Gallery

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12957 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/ad2e1d91-03bd-4e47-b679-81c42414238b?source=cve · Nota
• https://twitter.com/RedPacketSec/status/2012332005694861431 · Publicação no Twitter
• https://twitter.com/vuldb/status/2012136302179688854 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2012126450904605050 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3405593/all-in-one-video-gallery · Nota