Arbitrary File Inclusion Vulnerability in All-in-One Video Gallery Plugin

CVE-2024-4670

Summary

The All-in-One Video Gallery Plugin for WordPress is susceptible to a Local File Inclusion vulnerability that impacts all versions up to and including 3.6.5. This security flaw arises through the use of the aiovg_search_form shortcode, enabling authenticated users with contributor-level permissions or higher to include and execute arbitrary files stored on the server. Exploiting this vulnerability could allow attackers to bypass access controls, extract sensitive data, and execute PHP code contained in those files. This risk is heightened as it permits the inclusion of files uploaded in formats typically deemed secure, such as images.

References