Analysis Report · Folder Analysis cache/all-in-one-video-gallery_4.5.7 → cache/all-in-one-video-gallery_4.6.4 — CVE-2025-12957

--- cache/all-in-one-video-gallery_4.5.7/admin/import-export.php	2026-01-16 00:19:59.779615425 +0000+++ cache/all-in-one-video-gallery_4.6.4/admin/import-export.php	2026-01-16 00:20:23.461102685 +0000@@ -63,8 +63,15 @@ 	 * @since 4.5.2
 	 */
 	public function ajax_callback_import_folder() {
+		@set_time_limit( 1200 );
+		ignore_user_abort( true );
+
 		check_ajax_referer( 'aiovg_ajax_nonce', 'security' ); // Verify the nonce for security
 
+		if ( ! current_user_can( 'manage_aiovg_options' ) ) {
+			wp_send_json_error( array( 'error' => esc_html__( 'You do not have sufficient permissions to do this action.', 'all-in-one-video-gallery' ) ) );
+		}
+
 		$response = array();
 
 		// Sanitize and extract folder path
@@ -254,8 +261,15 @@ 	 * @since 4.5.2
 	 */
 	public function ajax_callback_import_csv() {
+		@set_time_limit( 1200 );
+		ignore_user_abort( true );
+
 		check_ajax_referer( 'aiovg_ajax_nonce', 'security' ); // Verify the nonce for security
 
+		if ( ! current_user_can( 'manage_aiovg_options' ) ) {
+			wp_send_json_error( array( 'error' => esc_html__( 'You do not have sufficient permissions to do this action.', 'all-in-one-video-gallery' ) ) );
+		}
+
 		// Sanitize and extract parameters
 		$csv_file           = isset( $_POST['csv_file'] ) ? esc_url_raw( $_POST['csv_file'] ) : '';
 		$zip_file           = isset( $_POST['zip_file'] ) ? sanitize_text_field( wp_unslash( $_POST['zip_file'] ) ) : '';
@@ -415,6 +429,10 @@ 	public function ajax_callback_get_csv_columns() {
 		check_ajax_referer( 'aiovg_ajax_nonce', 'security' ); // Verify the nonce for security
 
+		if ( ! current_user_can( 'manage_aiovg_options' ) ) {
+			wp_send_json_error( array( 'error' => esc_html__( 'You do not have sufficient permissions to do this action.', 'all-in-one-video-gallery' ) ) );
+		}
+
 		// Sanitize and extract parameters.
 		$csv_file          = isset( $_POST['csv_file'] ) ? esc_url_raw( $_POST['csv_file'] ) : '';
 		$columns_separator = isset( $_POST['columns_separator'] ) ? sanitize_text_field( $_POST['columns_separator'] ) : ',';
@@ -478,8 +496,15 @@ 	 * @since 4.5.2
 	 */
 	public function ajax_callback_export_csv() {
+		@set_time_limit( 1200 );
+		ignore_user_abort( true );
+
 		check_ajax_referer( 'aiovg_ajax_nonce', 'security' ); // Verify the nonce for security
 
+		if ( ! current_user_can( 'manage_aiovg_options' ) ) {
+			wp_send_json_error( array( 'error' => esc_html__( 'You do not have sufficient permissions to do this action.', 'all-in-one-video-gallery' ) ) );
+		}
+
 		// Sanitize and extract parameters
 		$offset    = isset( $_POST['offset'] ) ? (int) $_POST['offset'] : 0;
 		$limit     = isset( $_POST['limit'] ) ? (int) $_POST['limit'] : 200;
@@ -786,8 +811,15 @@ 	 * @since 4.5.2
 	 */
 	public function ajax_callback_export_zip() {
+		@set_time_limit( 1200 );
+		ignore_user_abort( true );
+
 		check_ajax_referer( 'aiovg_ajax_nonce', 'security' ); // Verify the nonce for security
 
+		if ( ! current_user_can( 'manage_aiovg_options' ) ) {
+			wp_send_json_error( array( 'error' => esc_html__( 'You do not have sufficient permissions to do this action.', 'all-in-one-video-gallery' ) ) );
+		}
+
 		if ( ! class_exists( 'ZipArchive' ) ) {
 			wp_send_json_error( array( 'error' => __( 'ZIP creation is not supported on your server. This feature requires the PHP "ZipArchive" class. Please ask your hosting provider to enable the PHP ZIP extension, or upgrade PHP to a version that includes it.', 'all-in-one-video-gallery' ) ) );		
 		}
@@ -1247,12 +1279,57 @@ 			return new WP_Error( 'mkdir_failed', __( 'Sorry, we were unable to create the import directory. Please check your folder permissions and try again.', 'all-in-one-video-gallery' ) );
 		}
 
+		// Create protection files safely inside the extract path
+		$htaccess_file   = trailingslashit( $extract_path ) . '.htaccess';
+		$webconfig_file  = trailingslashit( $extract_path ) . 'web.config';
+		$htaccess_rules  = "Deny from all\n";
+		$webconfig_rules = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
+			. "<configuration>\n"
+			. "\t<system.webServer>\n"
+			. "\t\t<authorization>\n"
+			. "\t\t\t<deny users=\"*\" />\n"
+			. "\t\t</authorization>\n"
+			. "\t</system.webServer>\n"
+			. "</configuration>";
+
+		if ( false === @file_put_contents( $htaccess_file, $htaccess_rules ) ) {
+			return new WP_Error( 'file_write_failed', __( 'We were unable to complete a required file operation. Please make sure your server allows writing files.', 'all-in-one-video-gallery' ) );
+		}
+
+		if ( false === @file_put_contents( $webconfig_file, $webconfig_rules ) ) {
+			return new WP_Error( 'file_write_failed', __( 'We were unable to complete a required file operation. Please make sure your server allows writing files.', 'all-in-one-video-gallery' ) );
+		}
+
+		// Unzip
 		$unzip_result = unzip_file( $zip_file_path, $extract_path );
 		
 		if ( is_wp_error( $unzip_result ) ) {
+			// Remove protection files before returning
+			@unlink( $htaccess_file );
+			@unlink( $webconfig_file );
+
 			return $unzip_result;
 		}
 
+		// Keep only files allowed by WordPress MIME validation
+		$iterator = new RecursiveIteratorIterator(
+			new RecursiveDirectoryIterator( $extract_path, RecursiveDirectoryIterator::SKIP_DOTS ),
+			RecursiveIteratorIterator::CHILD_FIRST
+		);
+
+		foreach ( $iterator as $file ) {
+			if ( $file->isFile() ) {
+				$filetype = wp_check_filetype( $file->getFilename() );
+				if ( empty( $filetype['type'] ) ) {
+					@unlink( $file->getPathname() );
+				}
+			}
+		}
+
+		// Security cleanup
+		@unlink( $htaccess_file );
+		@unlink( $webconfig_file );
+
 		return untrailingslashit( $extract_path );
 	}
 
@@ -1297,8 +1374,6 @@ 	 * @return array   $response   Array containing import results.
      */
 	private function import_videos_from_folder( $videos, $attributes = array() ) {
-		set_time_limit( 1200 );
-
 		$response = array(
 			'total'    => count( $videos ),
 			'imported' => array(),
@@ -1404,8 +1479,6 @@ 	 * @return array   $response   Array containing import results.
      */
 	private function import_videos_from_csv( $videos, $attributes = array() ) {
-		set_time_limit( 1200 );
-
 		$response = array(
 			'total'    => count( $videos ),
 			'imported' => array(),

Let me analyze the provided diff for security vulnerabilities:

---

## Vulnerability 1: Unrestricted File Type Upload

**Vulnerability Existed:** yes

**CWE-434 - Unrestricted Upload of File with Dangerous Type - admin/import-export.php - Lines 1313-1320**

**Old Code:**
```php
$unzip_result = unzip_file( $zip_file_path, $extract_path );

if ( is_wp_error( $unzip_result ) ) {
    return $unzip_result;
}

return untrailingslashit( $extract_path );
```

**Fixed Code:**
```php
$unzip_result = unzip_file( $zip_file_path, $extract_path );

if ( is_wp_error( $unzip_result ) ) {
    // Remove protection files before returning
    @unlink( $htaccess_file );
    @unlink( $webconfig_file );

    return $unzip_result;
}

// Keep only files allowed by WordPress MIME validation
$iterator = new RecursiveIteratorIterator(
    new RecursiveDirectoryIterator( $extract_path, RecursiveDirectoryIterator::SKIP_DOTS ),
    RecursiveIteratorIterator::CHILD_FIRST
);

foreach ( $iterator as $file ) {
    if ( $file->isFile() ) {
        $filetype = wp_check_filetype( $file->getFilename() );
        if ( empty( $filetype['type'] ) ) {
            @unlink( $file->getPathname() );
        }
    }
}

// Security cleanup
@unlink( $htaccess_file );
@unlink( $webconfig_file );

return untrailingslashit( $extract_path );
```

**Explanation:**
The old code allowed extraction of ZIP files without validating file types. The fix adds validation using `wp_check_filetype()` to ensure only WordPress-approved file types are kept after extraction. Files with unrecognized MIME types are deleted, preventing malicious executable files from being extracted.

---

## Vulnerability 2: Missing Authorization Checks

**Vulnerability Existed:** yes

**CWE-862 - Missing Authorization - admin/import-export.php - Lines 66-70, 264-268, 432-436, 499-503, 814-818**

**Old Code:**
```php
public function ajax_callback_import_folder() {
    check_ajax_referer( 'aiovg_ajax_nonce', 'security' ); // Verify the nonce for security

    $response = array();
```

**Fixed Code:**
```php
public function ajax_callback_import_folder() {
    @set_time_limit( 1200 );
    ignore_user_abort( true );

    check_ajax_referer( 'aiovg_ajax_nonce', 'security' ); // Verify the nonce for security

    if ( ! current_user_can( 'manage_aiovg_options' ) ) {
        wp_send_json_error( array( 'error' => esc_html__( 'You do not have sufficient permissions to do this action.', 'all-in-one-video-gallery' ) ) );
    }

    $response = array();
```

**Explanation:**
The old code only verified the nonce but did not check user capabilities. Any authenticated user could execute these AJAX callbacks, including import/export operations. The fix adds `current_user_can( 'manage_aiovg_options' )` checks to all five AJAX callback functions, restricting them to users with proper permissions.

---

## Vulnerability 3: Directory Traversal Protection

**Vulnerability Existed:** yes

**CWE-22 - Improper Limitation of a Pathname to a Restricted Directory - admin/import-export.php - Lines 1280-1303**

**Old Code:**
```php
if ( ! wp_mkdir_p( $extract_path ) ) {
    return new WP_Error( 'mkdir_failed', __( 'Sorry, we were unable to create the import directory. Please check your folder permissions and try again.', 'all-in-one-video-gallery' ) );
}

$unzip_result = unzip_file( $zip_file_path, $extract_path );
```

**Fixed Code:**
```php
if ( ! wp_mkdir_p( $extract_path ) ) {
    return new WP_Error( 'mkdir_failed', __( 'Sorry, we were unable to create the import directory. Please check your folder permissions and try again.', 'all-in-one-video-gallery' ) );
}

// Create protection files safely inside the extract path
$htaccess_file   = trailingslashit( $extract_path ) . '.htaccess';
$webconfig_file  = trailingslashit( $extract_path ) . 'web.config';
$htaccess_rules  = "Deny from all\n";
$webconfig_rules = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
    . "<configuration>\n"
    . "\t<system.webServer>\n"
    . "\t\t<authorization>\n"
    . "\t\t\t<deny users=\"*\" />\n"
    . "\t\t</authorization>\n"
    . "\t</system.webServer>\n"
    . "</configuration>";

if ( false === @file_put_contents( $htaccess_file, $htaccess_rules ) ) {
    return new WP_Error( 'file_write_failed', __( 'We were unable to complete a required file operation. Please make sure your server allows writing files.', 'all-in-one-video-gallery' ) );
}

if ( false === @file_put_contents( $webconfig_file, $webconfig_rules ) ) {
    return new WP_Error( 'file_write_failed', __( 'We were unable to complete a required file operation. Please make sure your server allows writing files.', 'all-in-one-video-gallery' ) );
}

$unzip_result = unzip_file( $zip_file_path, $extract_path );
```

**Explanation:**
The fix adds `.htaccess` (Apache) and `web.config` (IIS) protection files that prevent direct access to extracted files via HTTP requests. This mitigates risks if an attacker manages to extract malicious files, preventing them from being served directly. These protection files are created before extraction and cleaned up afterward.

---

## Summary

The patch addresses three critical security issues:
1. **File upload validation** - prevents arbitrary file types from being extracted
2. **Authorization checks** - restricts AJAX operations to permitted users
3. **Access control** - prevents direct HTTP access to extracted temporary files

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to insufficient file type validation detecting VTT files, allowing double extension files to bypass sanitization while being accepted as a valid VTT file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.