---
id: "CVE-2026-120409"
page: "https://infrastack.ai/live/CVE-2026-120409"
kind: "vulnerability"
aliases: ["CVE-2026-120409"]
title: "WordPress All-in-One Video Gallery plugin leaks password-protected video sources"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "All-in-One Video Gallery", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["all-in-one-video-gallery", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-password-protected-videos", "plugin-updated"]
published_at: "2026-11-09T07:17:28+00:00"
first_seen_at: "2026-11-09T07:25:04+00:00"
updated_at: "2026-11-09T07:25:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120409", "first_seen_at": "2026-11-09T07:25:04+00:00"}]
exploit_sources: []
---

# WordPress All-in-One Video Gallery plugin leaks password-protected video sources

Link for people: https://infrastack.ai/live/CVE-2026-120409 (this .md is for agents)

The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page or download link. Unauthenticated visitors can obtain the media source of protected videos, such as unlisted YouTube or Vimeo links and external file URLs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:All-in-One Video Gallery affected range not listed fixed no fixed version listed

## How to check

- Check the installed version of the All-in-One Video Gallery plugin in the WordPress admin under Plugins, and see whether it is earlier than `5.1.1`.
- Look for password-protected videos on the site and test whether their player page or download link returns the media source without the password.

## Fix

- All-in-One Video Gallery plugin: move to `5.1.1` or later.

## Timeline

- 2026-11-09T07:25:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120409

## From the sources

The All-in-One Video Gallery  WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_