PT-2026-4521 · WordPress · All-In-One Video Gallery

Andrea Bocchetti · Publicado 2026-01-23 · Atualizado 2026-01-24 · CVE-2025-14947

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions All-in-One Video Gallery plugin for WordPress versions through 4.6.4

Description The All-in-One Video Gallery plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the ajax callback create bunny stream video, ajax callback get bunny stream video, and ajax callback delete bunny stream video functions. This allows unauthenticated attackers to create and delete videos on the Bunny Stream CDN linked to the victim’s account, if they can acquire a valid nonce, which is present in public player templates.

Recommendations Update to a version beyond 4.6.4.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14947

Produtos afetados

All-In-One Video Gallery

Referências · 9

• https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/bunny-stream.php#L131 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/bedfb712-faf6-4131-b254-e6d7c367f49f?source=cve · Nota
• https://twitter.com/CVEnew/status/2014995825777393923 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3441541 · Nota
• https://t.me/CVEtracker/42875 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/bunny-stream.php#L285 · Nota
• https://twitter.com/VulmonFeeds/status/2014857980055806004 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14947 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/includes/init.php#L373 · Nota