All-in-One Video Gallery WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the All-in-One Video Gallery plugin for WordPress, specifically in versions 4.5.4 to 4.5.7. The issue arises from inadequate file type validation in the resolve_import_directory() function. This vulnerability enables authenticated attackers with Author-level access and above to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution if the uploaded files are executed by the server.

Remediation

Users are advised to update the All-in-One Video Gallery plugin to version 4.6.4 or a newer patched version.