{"affected":[{"defaultStatus":"unaffected","product":"All-in-One Video Gallery","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.1.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-120409","cwes":["CWE-200"],"description":"The All-in-One Video Gallery  WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/9338a9fe-f978-444c-883c-697b0c581bc5/"}],"kev":null,"metrics":[],"modifiedAt":1794204027125,"publishedAt":1794204027125,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/9338a9fe-f978-444c-883c-697b0c581bc5/"}],"remediation":[],"revision":"8e4b62af0eaeaa0de0ad7997a517e70ee57dd153a60eaf553b6628bd306a3fb4","sources":[{"modifiedAt":1794204027125,"name":"CNA: WPScan","retrievedAt":1794208113502,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120409"}],"ssvc":null,"status":"published","title":"All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download Handler","updatedAt":1794208113502}