Security Alert Summary
The All-in-One Video Gallery plugin for WordPress contains an arbitrary file upload vulnerability affecting all versions up to and including 4.5.7. Insufficient file type validation for VTT files allows double-extension files to bypass sanitization. Authenticated users with author-level access or higher may be able to upload arbitrary files to the site, which could potentially enable remote code execution.
CVE Details
- CVE ID: CVE-2025-12957
- Affected component: All-in-One Video Gallery plugin for WordPress
- Affected versions: All versions up to, and including, 4.5.7
- Published: January 16, 2026 at 05:16:08 AM
- Last modified: January 16, 2026 at 03:55:12 PM
- CVSS v3.1: Base Score 8.8, Severity: HIGH, Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Authentication / Privileges / User Interaction: Authentication required; Privileges Required: Low (authenticated users such as authors and above); User Interaction: None
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness: CWE-434 (Unrestricted Upload of File with Dangerous Type)
Technical Details
The vulnerability is an arbitrary file upload issue caused by insufficient file type validation related to VTT files. The plugin’s sanitization logic fails to properly detect and reject double-extension filenames where a malicious upload can appear to be a valid .vtt file while carrying an executable or otherwise dangerous payload. Because the check accepts these crafted files as valid VTT files, authenticated users with author-level permissions or higher can upload files to the server.
This upload capability can allow an attacker to place files on the web server that were not intended to be hosted, and the CVE entry notes that this may make remote code execution possible. The CVE description does not name specific functions, hooks, or REST API endpoints involved.
How This Could Impact Your Website
Consider a site where the owner, internal content team (authors/editors), and external contractors all have accounts. An attacker with an author account — or a compromised author account — could upload a file masquerading as a VTT subtitle file but containing executable content. That uploaded file could be used to alter site files or execute code if the server serves or processes it in an unsafe way.
Practical consequences may include exposure of internal data (for example, user information), alteration of site content or functionality, and increased risk of targeted phishing or social engineering against staff or contributors if sensitive information is accessed. It does not automatically indicate a full site takeover, but the ability to upload arbitrary files raises the risk of more serious compromise depending on server configuration and other defenses.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a patched version.)
- Review and reduce unnecessary user roles and capabilities, especially for contributors and authors.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and file uploads for unusual behavior, and check file locations where uploads are stored for unexpected file types.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
