PT-2026-4521 · WordPress · All-In-One Video Gallery

Andrea Bocchetti · Published 2026-01-23 · Updated 2026-01-24 · CVE-2025-14947

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions All-in-One Video Gallery plugin for WordPress versions through 4.6.4

Description The All-in-One Video Gallery plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the ajax callback create bunny stream video, ajax callback get bunny stream video, and ajax callback delete bunny stream video functions. This allows unauthenticated attackers to create and delete videos on the Bunny Stream CDN linked to the victim’s account, if they can acquire a valid nonce, which is present in public player templates.

Recommendations Update to a version beyond 4.6.4.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14947

Affected Products

All-In-One Video Gallery

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-14947 · Security Note
• https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/bunny-stream.php#L131 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/bedfb712-faf6-4131-b254-e6d7c367f49f?source=cve · Note
• https://twitter.com/CVEnew/status/2014995825777393923 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3441541 · Note
• https://t.me/CVEtracker/42875 · Telegram Post
• https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/bunny-stream.php#L285 · Note
• https://twitter.com/VulmonFeeds/status/2014857980055806004 · Twitter Post
• https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/includes/init.php#L373 · Note