CVE-2021-24970
📋 TL;DR
This vulnerability in the All-in-One Video Gallery WordPress plugin allows attackers to include arbitrary local files on the server through an unsanitized 'tab' parameter. Attackers can read sensitive files like configuration files or potentially execute code if they can upload malicious files. WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- All-in-One Video Gallery WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, and website defacement.
Likely Case
Information disclosure of sensitive files like wp-config.php containing database credentials.
If Mitigated
Limited impact if file permissions are restrictive and web server runs with minimal privileges.
🎯 Exploit Status
Exploitation requires admin-level access. Public proof-of-concept code exists demonstrating file inclusion.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.0 and later
Vendor Advisory: https://wpscan.com/vulnerability/9b15d47e-43b6-49a8-b2c3-b99c92101e10
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'All-in-One Video Gallery'. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.5.0+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Remove vulnerable plugin
allTemporarily disable or remove the plugin until patched
wp plugin deactivate all-in-one-video-gallery
wp plugin delete all-in-one-video-gallery
Restrict admin access
linuxLimit WordPress admin panel access to trusted IP addresses only
# Add to .htaccess for Apache:
Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
# Add to nginx config:
location /wp-admin {
allow 192.168.1.0/24;
deny all;
}
🧯 If You Can't Patch
- Implement strict file permissions (644 for files, 755 for directories)
- Use web application firewall to block LFI patterns in requests
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → All-in-One Video Gallery → Version. If version is below 2.5.0, you are vulnerable.Check Version:
wp plugin get all-in-one-video-gallery --field=versionVerify Fix Applied:
Confirm plugin version is 2.5.0 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Requests to wp-admin/admin.php with tab parameter containing path traversal sequences (../../)
Network Indicators:
- HTTP requests to /wp-admin/admin.php?page=aiovg_videos&tab= with suspicious parameters
SIEM Query:
source="web_access.log" AND uri_path="/wp-admin/admin.php" AND query="*tab=*../*"