CVE-2026-118629 All-in-One Video Gallery CVE debrief

Who should care

Defenders of WordPress installations using the All-in-One Video Gallery plugin, especially those with private or sensitive video content, should assess exposure and take action to restrict access to private videos.

Why it matters

CVE-2026-118629 allows unauthenticated users to access titles and source URLs of private videos in All-in-One Video Gallery plugin before version 5.0.0. Defenders should assess exposure, verify configurations, and update to version 5.0.0 or later.

• Potential unauthorized access to sensitive video content
• Increased risk of video content exposure in video galleries
• Need for verification of player page configurations to prevent unauthorized access

Technical summary

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page. This allows unauthenticated users to view the title and source URLs of private, draft, pending, scheduled, and trashed videos by their ID. The vulnerability affects WordPress installations using the plugin, especially those with private or sensitive video content. Defenders should assess exposure, verify configurations, and update to version 5.0.0 or later to mitigate the vulnerability.

Defensive priority

Assess exposure of video galleries using All-in-One Video Gallery plugin versions before 5.0.0 and verify player page configurations.

Recommended defensive actions

• Assess exposure of video galleries using All-in-One Video Gallery plugin versions before 5.0.0
• Verify player page configurations to restrict access to private videos
• Update All-in-One Video Gallery plugin to version 5.0.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in All-in-One Video Gallery plugin. The vulnerability allows unauthenticated users to access titles and source URLs of private videos in All-in-One Video Gallery plugin before version 5.0.0. The source details are limited, and defenders should verify configurations and update to version 5.0.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.