WordPress Plugin Vulnerabilities

All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write

Description

The plugin does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.

Proof of Concept

Affects Plugins

Plugin icon
all-in-one-video-gallery
Fixed in 5.1.0

References

CVE
CVE-2026-119259

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
9595e671-3012-4809-a1c7-7f3690bf0455

Timeline

Publicly Published
2026-11-03 (about 3 days ago)
Added
2026-11-03 (about 2 days ago)
Last Updated
2026-11-03 (about 2 days ago)

Other

Published
Title
Published
2026-07-10
Title
WP Easy Pay < 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action
Published
2026-03-31
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.5.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Published
2026-02-25
Title
DEPART < 1.0.8 - Missing Authorization
Published
2024-07-08
Title
EventON < 2.2.16 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates
Published
2021-08-16
Title
Opal Estate <= 1.6.11 - Missing Authorization