CVE-2025-14947 is a missing authorization vulnerability (CWE-862) in the All-in-One Video Gallery plugin for WordPress, affecting all versions up to 4.6.4. The vulnerability arises from the lack of capability checks in the ajax_callback_create_bunny_stream_video, ajax_callback_get_bunny_stream_video, and ajax_callback_delete_bunny_stream_video functions. This allows unauthenticated attackers who obtain a valid nonce—exposed in public player templates—to create and delete videos on the Bunny Stream CDN associated with the victim's account. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

An attacker can modify video content on the Bunny Stream CDN linked to the victim's account by creating or deleting videos without authorization. This can disrupt availability of video content and potentially affect the integrity of the victim's media assets. There is no direct confidentiality impact reported. No known exploits are currently observed in the wild.

A patch is available for this vulnerability. Users of the All-in-One Video Gallery plugin should update to the fixed version beyond 4.6.4 as soon as possible to remediate the missing authorization checks. Until patched, restricting access to nonce values and limiting exposure of public player templates may reduce risk but is not a full mitigation.