The All-in-One Video Gallery plugin registers an unauthenticated file-download handler triggered by the query parameter '?vdl=<post_id>' on any 'aiovg_videos' post. This handler reads the 'mp4' meta value associated with the post and streams the response from that URL back to the requester. This behavior enables server-side request forgery (CWE-918), allowing an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing internal resources or services.

An attacker can exploit this SSRF vulnerability to make the server send HTTP requests to arbitrary URLs, which may lead to unauthorized access to internal network resources or services not otherwise accessible externally. The exact impact depends on the server environment and network configuration. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the vulnerable handler or implementing network-level controls to limit outbound requests from the server.