The All-in-One Video Gallery plugin registers an unauthenticated file-download handler triggered by the query parameter `?vdl=<post_id>` on any `aiovg_videos` post. This handler reads the `mp4` meta value of the post and streams the response from that URL back to the requester. This behavior enables server-side request forgery (CWE-918), allowing an attacker with low privileges to induce the server to make HTTP requests to arbitrary URLs. The CVSS v3.1 base score is 5.0, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and limited confidentiality impact. There is no known exploit in the wild and no vendor advisory or patch information available at this time.

An attacker with low privileges can exploit this SSRF vulnerability to make the server send HTTP requests to arbitrary URLs. This can lead to information disclosure limited to the confidentiality of the server's network environment. There is no direct impact on integrity or availability reported. The vulnerability could be leveraged to access internal resources or services not otherwise accessible externally.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable handler if possible and monitor for suspicious activity related to the `?vdl` parameter. Avoid exposing the plugin to untrusted users or networks.