Arbitrary File Upload Vulnerability in All-in-One Video Gallery Plugin by WordPress
CVE-2025-12966
8.8HIGH
What is CVE-2025-12966?
The All-in-One Video Gallery plugin for WordPress has a vulnerability that allows authenticated attackers, possessing Author-level access or higher, to upload files without proper validation. This weakness arises from the inadequate validation of file types in the resolve_import_directory() function, applicable to versions 4.5.4 through 4.5.7. Consequently, attackers could potentially execute arbitrary code on the server, posing a severe security risk to the affected site.
Affected Version(s)
All-in-One Video Gallery 4.5.4 <= 4.5.7