CVE-2026-12123 is a Server-Side Request Forgery vulnerability (CWE-918) in the All-in-One Video Gallery WordPress plugin by plugins360. It affects all versions up to and including 4.8.5. An attacker with subscriber-level privileges can insert an internal or loopback URL into the 'mp4' post meta of a newly created 'aiovg_videos' post using the XML-RPC 'wp.newPost' method. Subsequently, the attacker can trigger the unauthenticated '?vdl=<post_id>' endpoint, causing the server to fetch the specified URL and stream the response back to the attacker. This allows the attacker to interact with internal services and potentially modify information. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact. The affected product is a cloud-hosted service, and the vendor manages remediation server-side.

An attacker with subscriber-level access can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests to internal or external systems. This can lead to unauthorized information disclosure and modification of internal services accessible from the server. The vulnerability does not impact availability. The confidentiality and integrity impacts are partial. No known exploits are reported in the wild at this time.

The vendor manages remediation for this cloud-hosted service, and a patch is available. Users should verify with the vendor advisory for the current remediation status and ensure the service is updated accordingly. No additional mitigation steps are specified in the provided data.