CVE-2026-19256 · Package
NO FIX YET · SEE WHAT TO DO
The All In One Login WordPress plugin before 2.5.0 does not limit guesses against the short numeric code used for its default passwordless email login. Failed attempts are also not counted by its brute-force protection, so an unauthenticated attacker can guess the code and log in as any account, including administrators.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any WordPress site running the All In One Login plugin before 2.5.0 with its default passwordless email login enabled is exposed, because the login code can be guessed without limit. Sites that have removed the plugin or disabled the passwordless email login are not affected by this path. Teams that run WordPress for clients should check every site they manage.
Not affected if passwordless-login-disabled, plugin-updated
Who cares all-in-one-login, self-hosted, wordpress
wp-content/plugins/ for the All In One Login plugin; versions below 2.5.0 are in scope.2.5.0 or later (the sources state the fix is in versions before 2.5.0; the exact fixed version is per the NVD range).The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.