CVE-2024-4670 is a Local File Inclusion vulnerability classified under CWE-98, affecting the All-in-One Video Gallery plugin for WordPress in all versions up to and including 3.6.5. The vulnerability arises from improper control of filenames used in include or require statements within the plugin's aiovg_search_form shortcode functionality. Authenticated attackers with contributor-level permissions or higher can exploit this flaw to include arbitrary files from the server. This can be leveraged to execute arbitrary PHP code if attackers upload files containing malicious code, even if these files are disguised as images or other typically safe file types. The vulnerability allows bypassing of access controls, unauthorized data access, and full code execution on the server hosting the WordPress site. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity and requiring only low privileges and no user interaction. Although no public exploits have been reported yet, the vulnerability poses a significant risk to websites using this plugin, especially those allowing contributor-level user registrations. The lack of available patches at the time of reporting increases the urgency for mitigation.

The exploitation of CVE-2024-4670 can have severe consequences for affected organizations. Attackers can achieve remote code execution on the web server, potentially leading to full site compromise, data theft, defacement, or pivoting to internal networks. Confidential information stored on the server or accessible via the compromised WordPress site can be exposed. Integrity of website content and backend systems can be undermined, and availability may be disrupted through malicious actions such as deploying ransomware or deleting critical files. Since contributor-level access is sufficient to exploit the vulnerability, organizations with open or weak user registration policies are at higher risk. The vulnerability also undermines trust in the affected websites and can lead to reputational damage and regulatory consequences if sensitive data is leaked.

Organizations should immediately review user roles and restrict contributor-level access to trusted users only. Disable or remove the All-in-One Video Gallery plugin if it is not essential. Monitor for unusual file uploads or modifications, especially files with PHP code disguised as images or other media types. Implement web application firewall (WAF) rules to detect and block attempts to exploit the aiovg_search_form shortcode or suspicious include/require requests. If possible, apply virtual patching by restricting file inclusion paths or disabling dynamic file inclusion features in the plugin code. Regularly audit plugin versions and update to a patched version once released by the vendor. Conduct thorough security assessments of WordPress installations and enforce the principle of least privilege for all user accounts. Backup website data frequently and maintain incident response plans to quickly respond to potential compromises.