CVE-2025-14947

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14947", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-19T03:58:17.450Z", "datePublished": "2026-01-23T17:26:06.739Z", "dateUpdated": "2026-04-08T17:19:20.636Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:20.636Z"}, "affected": [{"vendor": "plugins360", "product": "All-in-One Video Gallery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.6.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_video`, `ajax_callback_get_bunny_stream_video`, and `ajax_callback_delete_bunny_stream_video` functions in all versions up to, and including, 4.6.4. This makes it possible for unauthenticated attackers to create and delete videos on the Bunny Stream CDN associated with the victim's account, provided they can obtain a valid nonce which is exposed in public player templates."}], "title": "All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bedfb712-faf6-4131-b254-e6d7c367f49f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/includes/init.php#L373"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/bunny-stream.php#L131"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/bunny-stream.php#L285"}, {"url": "https://plugins.trac.wordpress.org/changeset/3441541/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "timeline": [{"time": "2025-12-19T04:14:30.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-22T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T18:20:16.792303Z", "id": "CVE-2025-14947", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T18:20:37.750Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14947", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T18:20:16.792303Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T18:20:30.919Z"}}], "cna": {"title": "All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion", "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "plugins360", "product": "All-in-One Video Gallery", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.6.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-19T04:14:30.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-22T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bedfb712-faf6-4131-b254-e6d7c367f49f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/includes/init.php#L373"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/bunny-stream.php#L131"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/bunny-stream.php#L285"}, {"url": "https://plugins.trac.wordpress.org/changeset/3441541/"}], "descriptions": [{"lang": "en", "value": "The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_video`, `ajax_callback_get_bunny_stream_video`, and `ajax_callback_delete_bunny_stream_video` functions in all versions up to, and including, 4.6.4. This makes it possible for unauthenticated attackers to create and delete videos on the Bunny Stream CDN associated with the victim's account, provided they can obtain a valid nonce which is exposed in public player templates."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:20.636Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14947", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:19:20.636Z", "dateReserved": "2025-12-19T03:58:17.450Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-23T17:26:06.739Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "All-in-One Video Gallery", "vendor": "plugins360", "versions": [{"lessThanOrEqual": "4.6.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_video`, `ajax_callback_get_bunny_stream_video`, and `ajax_callback_delete_bunny_stream_video` functions in all versions up to, and including, 4.6.4. This makes it possible for unauthenticated attackers to create and delete videos on the Bunny Stream CDN associated with the victim's account, provided they can obtain a valid nonce which is exposed in public player templates."}, {"lang": "es", "value": "El plugin All-in-One Video Gallery para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una falta de verificaci\u00f3n de capacidad en las funciones 'ajax_callback_create_bunny_stream_video', 'ajax_callback_get_bunny_stream_video' y 'ajax_callback_delete_bunny_stream_video' en todas las versiones hasta la 4.6.4, inclusive. Esto hace posible que atacantes no autenticados creen y eliminen videos en la CDN de Bunny Stream asociada con la cuenta de la v\u00edctima, siempre que puedan obtener un nonce v\u00e1lido que se expone en las plantillas p\u00fablicas del reproductor."}], "id": "CVE-2025-14947", "lastModified": "2026-06-17T08:36:49.077", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14947", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T18:20:16.792303Z", "version": "2.0.3"}}]}, "published": "2026-01-23T18:16:02.070", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/includes/init.php#L373"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/bunny-stream.php#L131"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/bunny-stream.php#L285"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3441541/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bedfb712-faf6-4131-b254-e6d7c367f49f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:20:52.551834+00:00", "value": {"mitigation_remediation": ["Update the All\u2011In\u2011One Video Gallery plugin to the most recent version that includes a fix for the missing capability check.", "Block unauthenticated POST requests to the AJAX endpoints for Bunny Stream video creation, retrieval, and deletion by configuring the web server or a web\u2011application firewall to allow those actions only for authenticated sessions.", "Remove the publicly exposed nonce from the player templates or modify the plugin so the nonce is generated server\u2011side after authentication to prevent unauthorized request crafting."], "summary": {"action": "Patch or Mitigate", "impact": "Unauthorized creation and deletion of Bunny Stream videos"}, "threat_synthesis": {"affected_systems": "This issue affects all installations of the plugin up to and including version 4.6.4. Any WordPress site running the All\u2011In\u2011One Video Gallery on those versions \u2013 regardless of the WordPress theme or additional plugins \u2013 is potentially vulnerable. The risk is limited to sites that use the Bunny Stream CDN integration, because the attacker would need a valid Bearer token that normally belongs to the site owner. If the site is not using Bunny Stream, the vulnerability does not expose additional risk beyond a nominal denial of service on the CDN side.", "description_and_impact": "The All\u2011In\u2011One Video Gallery plugin for WordPress contains a missing capability check in three AJAX callback functions \u2013 one that creates, one that fetches, and one that deletes media objects on the Bunny Stream CDN. Because the plugin does not verify whether the requester has the proper WordPress role, an attacker can submit a request that triggers any of these callbacks and cause a new video to be uploaded to the victim\u2019s Bunny account or an existing video to be removed. The functions rely on a nonce for protection, but the nonce is embedded in public player templates and therefore can be obtained by an unauthenticated user.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity. The EPSS shows a very low likelihood of exploitation \u2013 the probability is below 1% \u2013 and the flaw is not listed in CISA\u2019s KEV catalog, further supporting the low current threat level. Nonetheless, the exposure of an operational nonce and the absence of an authorization check create a clear path for an unauthenticated attacker to alter data in a third\u2011party service, potentially leading to content loss or malicious content injection. Therefore, mitigation should be pursued before a broader vulnerability assessment or regulatory compliance review extends the risk window."}}}}, "created": "2026-01-26T11:49:03.005148+00:00", "updated": "2026-04-21T00:30:22.966939+00:00", "vendors": ["plugins360", "plugins360$PRODUCT$all-in-one_video_gallery", "wordpress", "wordpress$PRODUCT$wordpress"]}