CVE-2026-12123 is a Server-Side Request Forgery (SSRF) vulnerability in the All-in-One Video Gallery WordPress plugin (plugins360) affecting all versions up to and including 4.8.5. The vulnerability arises from improper validation of the 'vdl' parameter, allowing authenticated attackers with subscriber-level privileges to cause the server to make arbitrary HTTP requests. Attackers can plant internal or loopback URLs in the 'mp4' post meta field of a newly created 'aiovg_videos' post via the XML-RPC 'wp.newPost' method, then invoke the unauthenticated '?vdl=<post_id>' endpoint to force the server to fetch the URL and stream the response back to the attacker. This can lead to unauthorized querying and modification of internal services. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting medium severity with network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with subscriber-level access can exploit this vulnerability to make the server perform arbitrary HTTP requests to internal or external systems. This can lead to unauthorized disclosure of sensitive information from internal services and potential modification of data accessible via these requests. The vulnerability does not impact availability directly. The ability to access internal or loopback URLs can facilitate further attacks or information gathering within the internal network environment.

A patch is available for this vulnerability. Since this is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor's advisory for confirmation of patch deployment. Until patched, restrict subscriber-level access and monitor for suspicious activity related to the 'vdl' parameter. No additional mitigation steps are explicitly stated in the advisory.