Description
The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | All-in-One Video Gallery | < 5.1.1 | 5.1.1 |
References
- https://wpscan.com/vulnerability/9338a9fe-f978-444c-883c-697b0c581bc5/ exploit vdb-entry technical-description