CVE-2026-120409 in All-in-One Video Gallery Plugin
Summary
by MITRE • 11/09/2026
The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/09/2026
The vulnerability identified in All-in-One Video Gallery versions prior to 5.1.1 represents a critical failure in access control mechanisms within WordPress plugin architecture. This flaw specifically affects the handling of password-protected media content, allowing unauthenticated users to bypass intended security restrictions and retrieve sensitive video sources. The issue stems from insufficient validation logic when generating standalone player pages or download links for videos that have been configured with password protection by the site administrator.
From a technical perspective, the vulnerability arises because the plugin fails to verify whether a specific video asset is marked as protected before exposing its underlying media source URL through public-facing endpoints. When an attacker accesses these dedicated player pages or direct download links provided by the plugin, the system does not enforce authentication checks against the configured password requirements. Consequently, any individual with knowledge of the link structure can request and receive the raw media file location without providing valid credentials. This behavior effectively neutralizes the intended privacy controls set at the content level.
The operational impact of this vulnerability is significant for websites relying on this plugin to host sensitive or exclusive video content. Attackers can exploit this flaw to extract unlisted YouTube links, Vimeo embed URLs, and direct external file paths that were meant to be accessible only to authorized users. This exposure compromises data confidentiality and may lead to unauthorized distribution of copyrighted material, leakage of proprietary business presentations, or access to personal media intended for private audiences. The ease of exploitation is high since it requires no authentication credentials, making it susceptible to automated scanning tools targeting WordPress installations with this specific plugin version installed.
This vulnerability aligns closely with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the password logic was bypassed via default configurations or weak implementation patterns. In terms of attack vectors, it relates to ATT&CK technique T1078 Valid Accounts when considering how legitimate access controls are subverted by unauthenticated actors exploiting misconfigured permissions. The flaw essentially allows an attacker to treat protected resources as public ones due to a lack of server-side enforcement during resource retrieval operations.
Mitigation strategies should prioritize immediate upgrading to version 5.1.1 or later, where the developers have addressed these access control deficiencies. Until an update is applied, administrators can implement temporary workarounds such as disabling the standalone player feature if it is not strictly necessary for their use case. Additionally, configuring web application firewalls to monitor and block requests targeting known vulnerable endpoints associated with this plugin may provide a layer of defense against automated exploitation attempts. Regular audits of third-party plugins are essential to ensure that access control logic remains robust against evolving threat landscapes.