CVE-2026-120409: All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download Handler

Q: Who can exploit this issue?

Any unauthenticated visitor can exploit it if they can access the affected standalone player page or download link for a password-protected video. No password is required to obtain the media source through those paths.

Q: What information may be exposed?

The issue can disclose the media source for password-protected videos, including unlisted YouTube or Vimeo links and external file URLs. The disclosed source may allow direct access to the underlying media.

Q: Are password-protected videos still affected?

Yes. The vulnerable plugin versions do not verify password protection when serving videos through the standalone player page or download handler, so password protection does not protect those delivery paths.

Q: What version resolves the issue?

Update All-in-One Video Gallery to version 5.1.1 or later. Versions before 5.1.1 are affected.

Published Nov 9, 2026

Updated

The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.

Affected Software

1 affected component

All-in-One Video Gallery All-in-One Video Gallery<5.1.1

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated visitor can exploit it if they can access the affected standalone player page or download link for a password-protected video. No password is required to obtain the media source through those paths.

What information may be exposed?

The issue can disclose the media source for password-protected videos, including unlisted YouTube or Vimeo links and external file URLs. The disclosed source may allow direct access to the underlying media.

Are password-protected videos still affected?

Yes. The vulnerable plugin versions do not verify password protection when serving videos through the standalone player page or download handler, so password protection does not protect those delivery paths.

What version resolves the issue?

Update All-in-One Video Gallery to version 5.1.1 or later. Versions before 5.1.1 are affected.

CVE-2026-120409: All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download Handler

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information may be exposed?

Are password-protected videos still affected?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information may be exposed?

Are password-protected videos still affected?

What version resolves the issue?