All‑In‑One Video Gallery registers a public, unauthenticated file‑download handler triggered by '?vdl=[post_id]' on any 'aiovg_videos' post. The handler reads the post's 'mp4' meta value and streams that URL's response back to the requester. This lack of validation allows an attacker to ingest arbitrary external or internal resources, potentially exfiltrating data or probing the server's network. Based on the description, it is inferred that the vulnerability is a classic Server‑Side Request Forgery (CWE‑918) with the capacity to leak information and perform internal reconnaissance.

The vulnerability affects any WordPress site running the plugin 'All‑In‑One Video Gallery' with a version older than 4.9.2. Any instance that exposes the public/download endpoint is at risk; the issue can be exploited regardless of the site's authentication configuration, as the handler is publicly accessible.

The likely attack vector is an unauthenticated HTTP request to the public 'public/video.php' endpoint with the 'vdl' parameter pointing to a post ID that contains a malicious 'mp4' meta value. The EPSS score of 0.00162 (<1%) indicates a very low probability of exploitation, yet the potential to trigger arbitrary outbound requests from the server remains a moderate‑severity concern, reflected in the CVSS score of 5. No KEV listing signals limited known exploitation, yet the vulnerability's capacity for internal network discovery and data leakage makes it a moderate risk.