The vulnerability exists in the All‑in‑One Video Gallery WordPress plugin prior to version 5.1.0. The plugin fails to verify the type, status, or ownership of a target post before writing view‑count and duration metadata. As a result, any visitor—regardless of authentication status—can create or alter that metadata on any post, including private and draft posts, and can increase view counts without limit. This allows attackers to tamper with post statistics and potentially disrupt the integrity of content metrics, which could be leveraged for deceptive analytics or to flag erroneous data to site administrators.

Any WordPress installation that uses the All‑in‑One Video Gallery plugin with a version older than 5.1.0. The only vendor listed is "Unknown:All‑in‑One Video Gallery". No specific affected platform versions are listed beyond the overall plugin version constraint.

The plugin’s REST endpoint or AJAX handler is exploitable without any authentication, making the attack vector straightforward for an unauthenticated attacker. While no EPSS score is available and the vulnerability is not listed in CISA KEV, the lack of access control suggests a high likelihood of exploitation. The impact is primarily data integrity and potential denial of accurate analytics rather than direct code execution or system compromise.