WordPress Plugin Vulnerabilities

All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download Handler

Description

The plugin does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.

Proof of Concept

Affects Plugins

Plugin icon
all-in-one-video-gallery
Fixed in 5.1.1

References

CVE
CVE-2026-120409

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
9338a9fe-f978-444c-883c-697b0c581bc5

Timeline

Publicly Published
2026-11-06 (about 3 days ago)
Added
2026-11-06 (about 2 days ago)
Last Updated
2026-11-06 (about 2 days ago)

Other

Published
Title
Published
2026-05-26
Title
SePay Gateway < 1.1.21 - Unauthenticated Information Exposure
Published
2025-03-07
Title
All-in-One Addons for Elementor – WidgetKit <= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
Published
2022-09-22
Title
Customer Reviews for WooCommerce < 5.3.6 - Unauthenticated Sensitive Information Disclosure
Published
2026-11-03
Title
Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajax
Published
2026-10-13
Title
Avada (Fusion) Builder < 3.16.2 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token