PT-2026-140244
CVE-2026-120409
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾