{"id":"CVE-2026-120409","kind":"vulnerability","aliases":["CVE-2026-120409"],"related":[],"title":"WordPress All-in-One Video Gallery plugin leaks password-protected video sources","description":"The All-in-One Video Gallery  WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.","summary":"The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page or download link. Unauthenticated visitors can obtain the media source of protected videos, such as unlisted YouTube or Vimeo links and external file URLs.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"All-in-One Video Gallery","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["all-in-one-video-gallery","package","self-hosted","wordpress"],"not_affected_if":["no-password-protected-videos","plugin-updated"],"how_to_check":"- Check the installed version of the All-in-One Video Gallery plugin in the WordPress admin under Plugins, and see whether it is earlier than `5.1.1`.\n- Look for password-protected videos on the site and test whether their player page or download link returns the media source without the password.","fix":"- All-in-One Video Gallery plugin: move to `5.1.1` or later.","status":"open","published_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:45+00:00","updated_at":"2026-11-09T07:25:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T07:25:45Z","model":"claude-haiku-5-5","output":{"fix":"- All-in-One Video Gallery plugin: move to `5.1.1` or later.","reach":"internet","title":"WordPress All-in-One Video Gallery plugin leaks password-protected video sources","impact":"low","summary":"The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page or download link. Unauthenticated visitors can obtain the media source of protected videos, such as unlisted YouTube or Vimeo links and external file URLs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","all-in-one-video-gallery","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated visitors obtain media sources of protected videos","analyst_note":"","how_to_check":"- Check the installed version of the All-in-One Video Gallery plugin in the WordPress admin under Plugins, and see whether it is earlier than `5.1.1`.\n- Look for password-protected videos on the site and test whether their player page or download link returns the media source without the password.","plain_action":"","product_name":"All-in-One Video Gallery","needs_analyst":false,"not_affected_if":["no-password-protected-videos","plugin-updated"],"who_is_affected":"Sites running the All-in-One Video Gallery WordPress plugin before `5.1.1` that host password-protected videos. The flaw exposes the media source through the standalone player page and download link, so sites without password-protected videos or without the plugin can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4553,"output_tokens":596,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120409':17A,20A '-2026':16A,19A '5.1.1':48B,100C 'all':22A 'all-in-on':2A,39B,91C 'all-in-one':21A 'all-in-one-video-galleri':27B 'allow':122C 'check':51B,103C 'cve':15A,18A 'download':67B,120C 'extern':87B,143C 'file':88B,144C 'galleri':7A,32B,44B,96C 'gallery':26A 'host':36B 'in':23A 'leak':9A 'link':68B,85B,121C,141C 'media':74B,128C 'obtain':72B,126C 'one':5A,24A,30B,42B,94C 'packag':33B 'page':65B,117C 'password':11A,56B,108C,132C 'password-protect':10A,131C 'player':64B,116C 'plugin':8A,46B,98C 'protect':12A,57B,77B,109C,133C 'self':35B 'self-host':34B 'serv':59B,111C 'sourc':14A,75B,129C 'standalon':63B,115C 'unauthent':69B,123C 'unlist':81B,137C 'url':89B,145C 'video':6A,13A,25A,31B,43B,54B,78B,95C,106C,134C 'vimeo':84B,140C 'visitor':70B,124C 'whether':52B,104C 'wordpress':1A,37B,45B,97C 'youtub':82B,138C","nicknames":[],"mitigations":[],"who_affected":"Sites running the All-in-One Video Gallery WordPress plugin before `5.1.1` that host password-protected videos. The flaw exposes the media source through the standalone player page and download link, so sites without password-protected videos or without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["allinonevideogallery","videogallery"],"ptokens":["all","gallery","in","one","video"],"labels":["allinonevideogallery","medium","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-120409':17A,20A '-2026':16A,19A 'all':22A 'all-in-on':2A 'all-in-one':21A 'cve':15A,18A 'galleri':7A 'gallery':26A 'in':23A 'leak':9A 'one':5A,24A 'password':11A 'password-protect':10A 'plugin':8A 'protect':12A 'sourc':14A 'video':6A,13A,25A 'wordpress':1A","search_b":"'5.1.1':48B 'all-in-on':39B 'all-in-one-video-galleri':27B 'check':51B 'download':67B 'extern':87B 'file':88B 'galleri':32B,44B 'host':36B 'link':68B,85B 'media':74B 'obtain':72B 'one':30B,42B 'packag':33B 'page':65B 'password':56B 'player':64B 'plugin':46B 'protect':57B,77B 'self':35B 'self-host':34B 'serv':59B 'sourc':75B 'standalon':63B 'unauthent':69B 'unlist':81B 'url':89B 'video':31B,43B,54B,78B 'vimeo':84B 'visitor':70B 'whether':52B 'wordpress':37B,45B 'youtub':82B","search_c":"'5.1.1':100C 'all-in-on':91C 'allow':122C 'check':103C 'download':120C 'extern':143C 'file':144C 'galleri':96C 'link':121C,141C 'media':128C 'obtain':126C 'one':94C 'page':117C 'password':108C,132C 'password-protect':131C 'player':116C 'plugin':98C 'protect':109C,133C 'serv':111C 'sourc':129C 'standalon':115C 'unauthent':123C 'unlist':137C 'url':145C 'video':95C,106C,134C 'vimeo':140C 'visitor':124C 'whether':104C 'wordpress':97C 'youtub':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120409","severity":null,"published_at":"2026-11-09T07:17:28+00:00","modified_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}