CyberRota Analysis
AI-GeneratedThe All-in-One Video Gallery plugin contains a vulnerability that allows unauthenticated users to exploit a public file-download handler, enabling them to download video files by manipulating the `?vdl=<post_id>` parameter. This could lead to unauthorized access to sensitive video content hosted on the platform. Developers and administrators using this plugin should prioritize addressing this issue to prevent potential data leaks and unauthorized content distribution.
Original NVD Description
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester.