The All‑in‑One Video Gallery plugin for WordPress is vulnerable to Server‑Side Request Forgery (CWE‑918) in all versions up to, and including, 4.8.5 via the 'vdl' parameter. An attacker with subscriber‑level access (or higher) can embed an arbitrary internal or loopback URL in the mp4 post meta of a newly created aiovg_videos post via XML‑RPC wp.newPost and then trigger the '?vdl=<post_id>' endpoint. The server will fetch that URL and stream the response back, allowing the attacker to query or modify information from internal services, potentially enabling data exfiltration or unauthorized configuration changes within the host network.

All WordPress sites using the All‑in‑One Video Gallery plugin (from plugins360) version 4.8.5 or older are affected. These sites expose a public '?vdl=' endpoint and allow subscriber‑level users to create video posts, creating the conditions for the SSRF to be triggered.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of <1% shows a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires the attacker to own a subscriber‑level account to create a video post and then use the unauthenticated '?vdl=<post_id>' endpoint to initiate the request. If exploited, the attacker could read or alter sensitive internal data, and it is inferred that the relatively simple attack path may attract adversaries with moderate skill.