This vulnerability allows unauthenticated visitors to retrieve the media source of videos that have been password-protected by the All‑In‑One Video Gallery WordPress plugin. The plugin fails to verify the password status before delivering the video via its stand‑alone player page or download link, exposing the actual video URLs—such as unlisted YouTube, Vimeo, or external files—to any user on the site. The primary impact is the disclosure of otherwise protected media content, which could compromise confidentiality if the videos contain sensitive material.

All sites using the All‑In‑One Video Gallery plugin version earlier than 5.1.1 are affected. The vendor is identified as Unknown:All‑In‑One Video Gallery, and the unpatched versions lack the necessary checks for password protection. No other products are listed.

This is a remote, unauthenticated attack that requires access to the website’s public URLs. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of exploitation is unknown. The impact is likely moderate to high depending on the sensitivity of the disclosed videos, but no formal CVSS score is provided. Since the attacker does not need elevated privileges, the risk is widespread across all affected sites until the plugin is updated.