Is CVE-2026-119259 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119259 being exploited in the wild.

How severe is CVE-2026-119259?

Informational severity, published 6 November 2026.

Which products and versions are affected?

Wordpress All-in-One Video Gallery before 5.1.0.

Is there a fix for CVE-2026-119259?

Yes: fixed in 5.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119259 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119259?

Check whether you run Wordpress All-in-One Video Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119259: All-in-One Video Gallery unauthenticated meta write

CVE-2026-119259 · Severity: info · Published 2026-11-06

The All-in-One Video Gallery WordPress plugin fails to verify post ownership or status when updating view counts and duration metadata, allowing unauthenticated attackers to modify these fields on any post including private and draft posts. This enables unauthorized changes to post metadata and unlimited view count inflation, undermining post authenticity and analytics accuracy.

Vendors: Wordpress.

Quick answers

Is CVE-2026-119259 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119259 being exploited in the wild.
How severe is CVE-2026-119259?: Informational severity, published 6 November 2026.
Which products and versions are affected?: Wordpress All-in-One Video Gallery before 5.1.0.
Is there a fix for CVE-2026-119259?: Yes: fixed in 5.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119259 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119259?: Check whether you run Wordpress All-in-One Video Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.1.0

Technical details

The plugin performs unauthenticated writes of post meta (view count and duration) without checking post type, status, or ownership. This is a missing authorization vulnerability (CWE-862) allowing any visitor to create or modify metadata on arbitrary posts via network access, with no authentication or user interaction required. A fix exists in version 5.1.0.

Affected products

WordPress All-in-One Video Gallery before 5.1.0

Timeline

2026-11-03: disclosed

References

https://wpscan.com/vulnerability/9595e671-3012-4809-a1c7-7f3690bf0455/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.