high · CVSS v3 7.5

CVE-2026-120409

The All-in-One Video Gallery WordPress plugin before 5.1.1 fails to enforce password protection on its standalone player and download links,

Overview

The All-in-One Video Gallery WordPress plugin before 5.1.1 fails to enforce password protection on its standalone player and download links, exposing media source URLs of protected videos. This allows unauthenticated users to retrieve URLs for password-protected content, including unlisted YouTube, Vimeo, or external files. The vulnerability can lead to unintended content disclosure.

Description

The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.

Impact

Confidentiality: The media source URLs of password-protected videos are exposed, potentially revealing sensitive or private content. Integrity: The plugin does not alter content, so integrity is not directly affected. Availability: No impact. Defenders: Site administrators and content owners must ensure proper access controls.

Remediation

Update the plugin to version 5.1.1 or later. If an update is not possible, disable the standalone player and download link for protected videos or restrict access via .htaccess or plugin settings. Verify that password protection is enforced by testing the player page. Monitor logs for unauthorized access attempts.

Risk context

High severity (CVSS 7.5) indicates significant risk of content disclosure. No EPSS data is available. Defenders should prioritize patching to mitigate the vulnerability.

Affected products

  • All-in-One Video Gallery
  • WordPress plugin

Scores

Severity
high
CVSS v2
5
CVSS v3
7.5
CVSS v4
—
EPSS
—

wordpress plugin content-disclosure password-protected media-source high-severity access-control

← All CVEs

Related CVEs

high

CVE-2026-124501

Tidelift moto up to 5.2.4 contains a privilege escalation flaw in the AWS Batch Emulation component. The vulnerability allows remote attackers to manipulate the privileged/volumes argument, leading to improper privilege management. It can be exploited without authentication.

View analysis

high

CVE-2026-124509

A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component.

View analysis

high

CVE-2026-124554

A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

high

CVE-2026-124557

A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis