Unauthenticated File Download Vulnerability in All-in-One Video Gallery by WordPress
CVE-2026-19075
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
What is CVE-2026-19075?
The All-in-One Video Gallery plugin for WordPress is vulnerable to an unauthenticated file download exploit. This occurs through a public file-download handler that can be triggered by accessing a specific URL pattern (?vdl=<post_id>). When this endpoint is accessed, it allows any user to initiate a download of the media files linked to the post by directly reading the mp4 meta value associated with the aiovg_videos posts and streaming the response back. This vulnerability could potentially expose sensitive media files to unauthorized users.
Affected Version(s)
All-in-One Video Gallery 0 < 4.9.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.