PT-2025-49357 · WordPress · All-In-One Video Gallery

Kenneth Dunn · Published 2025-12-06 · Updated 2025-12-11 · CVE-2025-12966

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions All-in-One Video Gallery versions 4.5.4 through 4.5.7

Description The All-in-One Video Gallery plugin for WordPress has a flaw that allows unauthorized file uploads. This is due to a lack of proper file type checking within the resolve import directory() function. Attackers with Author-level access or higher can upload any file type to the server, potentially leading to remote code execution. The vulnerable parameter is the file being uploaded through the import directory functionality.

Recommendations Update to a version of All-in-One Video Gallery that addresses this issue.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-12966

Affected Products

All-In-One Video Gallery

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12966 · Security Note
• https://t.me/CVEtracker/39001 · Telegram Post
• https://t.me/cveNotify/145007 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1997266050837012968 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0b03bca1-84e3-4220-b39b-69044c42e9f9?source=cve · Note
• https://twitter.com/CveFindCom/status/1997254553343836545 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3405593/all-in-one-video-gallery/trunk/admin/import-export.php · Note
• https://twitter.com/cracbot/status/1999071718971994132 · Twitter Post
• https://twitter.com/CVEnew/status/1997257379407102273 · Twitter Post