Description

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-06T06:16:41.360Z",
  "pubdate": "2026-11-06T06:16:41.360Z",
  "executiveSummary": "The All-in-One Video Gallery WordPress plugin, specifically versions prior to 5.1.0, contains an improper access control vulnerability that allows unauthenticated remote attackers to modify post metadata.\nThe vulnerability resides in the plugin's failure to perform authorization checks or validate post status/ownership before updating specific meta fields such as view counts and duration.\nBy manipulating these fields, an attacker can perform unauthorized modifications to any post within the WordPress installation, regardless of its visibility status (e.g., private or draft).\nThis flaw presents significant risk, including the ability to artificially inflate engagement metrics (view counts) and potentially expose metadata information for non-public content.\nExploitation does not require prior authentication or elevated privileges, making it accessible to any unauthenticated visitor who can interact with the vulnerable endpoint.\nThe attack vector is network-based, allowing an attacker to craft specific requests to the plugin's metadata update mechanism to alter arbitrary post records.",
  "technicalDetails": "The vulnerability is rooted in an insufficient authorization logic within the metadata update process of the All-in-One Video Gallery plugin. Specifically, the function responsible for updating 'view count' and 'duration' meta fields lacks server-side verification of the target post's identity and current access permissions.\nIn the vulnerable versions (prior to 5.1.0), the plugin processes incoming update requests without validating if the current session or request context has the necessary permissions to edit the specified post ID. Furthermore, there is no validation logic to confirm that the requested post ID corresponds to a public media object managed by the plugin, nor does it verify the status or ownership of the post.\nAn attacker can exploit this by intercepting or crafting HTTP requests directed at the plugin's metadata management endpoint. Because the application logic proceeds to execute database update operations (likely utilizing functions like update_post_meta) without validating the authorization state of the request, an attacker can inject arbitrary values into the post meta database table.\nThe attack flow follows these steps: 1) The attacker identifies a target Post ID (which can be obtained through standard WordPress enumeration techniques). 2) The attacker crafts a request mimicking the structure expected by the plugin for updating view counts or video duration. 3) The request is submitted to the server without any authentication headers. 4) The plugin's backend logic, failing to perform an 'is_user_logged_in()' or 'current_user_can()' check, processes the request and executes the update command on the specified Post ID. 5) The database is updated, causing the meta values to reflect the attacker-supplied data.\nThe impact is twofold: First, it allows for the subversion of analytics and metrics by enabling infinite inflation of view counts. Second, the ability to interact with private or draft posts allows for unauthorized data manipulation of sensitive or unpublished content. This violates the core WordPress security model, which dictates that post meta modifications should only be accessible to authorized administrators or post owners.\nThere is no mechanism in the affected versions to rate-limit these requests or bind the metadata updates to the authenticated session of a legitimate user, facilitating automated abuse and mass modification of post metadata across the affected site."
}