Analysis Report · Folder Analysis cache/all-in-one-video-gallery_4.6.4 → cache/all-in-one-video-gallery_4.7.1 — CVE-2025-15516

---

## Security Analysis Report

**Vulnerability #1: Arbitrary User Metadata Update - Authorization Bypass**

Vulnerability Existed: yes
TRUE POSITIVE

CWE-863 Incorrect Authorization - CWE-863 - admin/admin.php lines 1066-1071

**Old Code:**
```php
$key     = isset( $_POST['key'] ) ? sanitize_text_field( $_POST['key'] ) : '';
$value   = isset( $_POST['value'] ) ? sanitize_text_field( $_POST['value'] ) : '';

if ( ! empty( $user_id ) && ! empty( $key ) ) {
    update_user_meta( $user_id, $key, $value );
}
```

**Fixed Code:**
```php
if ( ! $user_id ) {
    wp_die();
}

if ( ! current_user_can( 'manage_aiovg_options' ) ) {
    wp_die();
}

$key = isset( $_POST['key'] ) ? sanitize_key( $_POST['key'] ) : '';
$allowed_keys = array( 'aiovg_video_form_tour', 'aiovg_automation_form_tour' );

if ( ! in_array( $key, $allowed_keys ) ) {
    wp_die();
}

$value = isset( $_POST['value'] ) ? trim( $_POST['value'] ) : 0;
if ( 'completed' !== $value ) {
    $value = (int) $value;
}

update_user_meta( $user_id, $key, $value );
```

**Explanation:**
The old code allowed any user with any capability level to update arbitrary user metadata through the AJAX handler. The vulnerabilities fixed include:

1. **Missing Authorization Check**: The old code only checked if `$user_id` was non-empty, but didn't verify the user had permission (`manage_aiovg_options` capability).
2. **Arbitrary Key Injection**: The old code accepted any POST key without validation. An attacker could update any user metadata key. Fixed by implementing a whitelist of allowed keys (`aiovg_video_form_tour`, `aiovg_automation_form_tour`).
3. **Type Confusion/Injection**: The old code used `sanitize_text_field()` on the value without type validation, allowing arbitrary data. Fixed by restricting values to specific types: either 'completed' string or integer values.
4. **Weak Sanitization for Keys**: Changed from `sanitize_text_field()` to `sanitize_key()`, which is the appropriate function for sanitizing metadata keys.

---

**Vulnerability #2: Missing Authentication Verification**

Vulnerability Existed: yes
TRUE POSITIVE

CWE-287 Improper Authentication - CWE-287 - admin/admin.php lines 1069-1073

**Old Code:**
```php
if ( ! empty( $user_id ) && ! empty( $key ) ) {
    update_user_meta( $user_id, $key, $value );
}

wp_die();
```

**Fixed Code:**
```php
if ( ! $user_id ) {
    wp_die();
}

if ( ! current_user_can( 'manage_aiovg_options' ) ) {
    wp_die();
}
```

**Explanation:**
The old code relied on a weak check (`! empty( $user_id )`), which would pass even for users with user ID 0 theoretically (though unlikely). More critically, it allowed any authenticated user to execute the metadata update without verifying they had the required capability. The fix adds explicit authentication and authorization verification, terminating execution immediately if the user lacks the `manage_aiovg_options` capability, which is a proper WordPress permission check.