{"id":"CVE-2026-119259","kind":"vulnerability","aliases":["CVE-2026-119259"],"related":[],"title":"WordPress video gallery plugin lets visitors alter view counts on any post","description":"The All-in-One Video Gallery  WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.","summary":"The All-in-One Video Gallery WordPress plugin, before version 5.1.0, does not verify the type, status or ownership of a post before writing its view count and duration data. An unauthenticated visitor can therefore change that metadata on any post, including private and draft posts, and inflate view counts without limit.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["all-in-one-video-gallery","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-5.1.0-or-later"],"how_to_check":"- Check the installed version of the All-in-One Video Gallery plugin in the WordPress admin under Plugins.\n- Confirm whether the plugin is active on the site.","fix":"- All-in-One Video Gallery plugin: move to `5.1.0` or later.","status":"open","published_at":"2026-11-06T06:16:41+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:47+00:00","updated_at":"2026-11-06T06:41:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T06:41:47Z","model":"claude-haiku-5-5","output":{"fix":"- All-in-One Video Gallery plugin: move to `5.1.0` or later.","reach":"internet","title":"WordPress video gallery plugin lets visitors alter view counts on any post","impact":"low","summary":"The All-in-One Video Gallery WordPress plugin, before version 5.1.0, does not verify the type, status or ownership of a post before writing its view count and duration data. An unauthenticated visitor can therefore change that metadata on any post, including private and draft posts, and inflate view counts without limit.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","all-in-one-video-gallery"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attackers alter post metadata and inflate view counts without limit","analyst_note":"","how_to_check":"- Check the installed version of the All-in-One Video Gallery plugin in the WordPress admin under Plugins.\n- Confirm whether the plugin is active on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-5.1.0-or-later"],"who_is_affected":"Any WordPress site running the All-in-One Video Gallery plugin before `5.1.0` is exposed, because the flaw is reachable without logging in. The impact is limited to view count and duration metadata, but it can reach private and draft posts. Sites that do not run this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000694,"input_tokens":4219,"output_tokens":545,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119259':15A,18A '-2026':14A,17A '5.1.0':41B,93C 'all-in-on':31B,84C 'all-in-one-video-galleri':19B 'allow':114C 'alter':7A 'chang':66B,120C 'check':96C 'count':9A,57B,80B,110C,136C 'creat':118C 'cve':13A,16A 'data':60B 'draft':75B,129C 'durat':59B,112C 'galleri':3A,24B,36B,89C 'includ':72B,126C 'inflat':78B,133C 'let':5A 'limit':82B,138C 'meta':113C,122C 'metadata':68B 'one':22B,34B,87C 'ownership':49B,101C 'packag':25B 'plugin':4A,29B,38B,91C 'post':12A,52B,71B,76B,105C,125C,130C 'privat':73B,127C 'status':47B,99C 'target':104C 'therefor':65B 'type':46B,98C 'unauthent':62B,115C 'verifi':44B 'version':40B 'video':2A,23B,35B,88C 'view':8A,56B,79B,109C,135C 'visitor':6A,63B,116C 'without':81B,137C 'wordpress':1A,26B,28B,37B,90C 'wordpress-plugin':27B 'write':54B,107C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the All-in-One Video Gallery plugin before `5.1.0` is exposed, because the flaw is reachable without logging in. The impact is limited to view count and duration metadata, but it can reach private and draft posts. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["allinonevideogallery","low","package","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-119259':15A,18A '-2026':14A,17A 'alter':7A 'count':9A 'cve':13A,16A 'galleri':3A 'let':5A 'plugin':4A 'post':12A 'video':2A 'view':8A 'visitor':6A 'wordpress':1A","search_b":"'5.1.0':41B 'all-in-on':31B 'all-in-one-video-galleri':19B 'chang':66B 'count':57B,80B 'data':60B 'draft':75B 'durat':59B 'galleri':24B,36B 'includ':72B 'inflat':78B 'limit':82B 'metadata':68B 'one':22B,34B 'ownership':49B 'packag':25B 'plugin':29B,38B 'post':52B,71B,76B 'privat':73B 'status':47B 'therefor':65B 'type':46B 'unauthent':62B 'verifi':44B 'version':40B 'video':23B,35B 'view':56B,79B 'visitor':63B 'without':81B 'wordpress':26B,28B,37B 'wordpress-plugin':27B 'write':54B","search_c":"'5.1.0':93C 'all-in-on':84C 'allow':114C 'chang':120C 'check':96C 'count':110C,136C 'creat':118C 'draft':129C 'durat':112C 'galleri':89C 'includ':126C 'inflat':133C 'limit':138C 'meta':113C,122C 'one':87C 'ownership':101C 'plugin':91C 'post':105C,125C,130C 'privat':127C 'status':99C 'target':104C 'type':98C 'unauthent':115C 'video':88C 'view':109C,135C 'visitor':116C 'without':137C 'wordpress':90C 'write':107C","first_public_at":"2026-11-06T06:16:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119259","severity":null,"published_at":"2026-11-06T06:16:41+00:00","modified_at":"2026-11-06T06:16:41+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}