{
 "id": "WPSEC-2026-2444",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2444/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2444/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2444/index.md",
 "title": "All-in-One Video Gallery <= 5.0.0 - Unauthenticated Missing Authorization to Post Meta Update via 'aiovg_update_views_count' AJAX Action",
 "description": "The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check in the 'aiovg_update_views_count' AJAX action in all versions up to, and including, 5.0.0. The handler did not verify that the supplied post is a video the visitor is allowed to view and play. This makes it possible for unauthenticated attackers to update view count and duration post meta on arbitrary posts, including private or draft videos.",
 "plugin": {
  "slug": "all-in-one-video-gallery",
  "name": "All-in-One Video Gallery",
  "full_name": "All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos",
  "wordpress_org": "https://wordpress.org/plugins/all-in-one-video-gallery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/all-in-one-video-gallery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/all-in-one-video-gallery"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1.0",
 "remediation": "Update to 5.1.0 or later.",
 "fix_released": "2026-11-03T06:12:08+00:00",
 "published": "2026-11-04T06:43:43+00:00",
 "updated": "2026-11-03T13:21:01.226504+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2444/",
  "https://plugins.svn.wordpress.org/all-in-one-video-gallery/tags/5.1.0/",
  "https://wordpress.org/plugins/all-in-one-video-gallery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/all-in-one-video-gallery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}