{"id":"CVE-2026-19256","kind":"vulnerability","aliases":["CVE-2026-19256"],"related":[],"title":"WordPress All In One Login plugin: weak code limits allow admin account takeover","description":"The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.","summary":"The All In One Login WordPress plugin before 2.5.0 does not limit guesses against the short numeric code used for its default passwordless email login. Failed attempts are also not counted by its brute-force protection, so an unauthenticated attacker can guess the code and log in as any account, including administrators.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["all-in-one-login","package","self-hosted","wordpress"],"not_affected_if":["passwordless-login-disabled","plugin-updated"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or in `wp-content/plugins/` for the All In One Login plugin; versions below `2.5.0` are in scope.\n- Check whether the passwordless email login feature is enabled in the plugin settings (the sources say it is enabled by default).","fix":"- All In One Login plugin: move to `2.5.0` or later (the sources state the fix is in versions before 2.5.0; the exact fixed version is per the NVD range).","status":"open","published_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:11+00:00","updated_at":"2026-11-05T06:33:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T06:33:11Z","model":"claude-haiku-5-5","output":{"fix":"- All In One Login plugin: move to `2.5.0` or later (the sources state the fix is in versions before 2.5.0; the exact fixed version is per the NVD range).","reach":"internet","title":"WordPress All In One Login plugin: weak code limits allow admin account takeover","impact":"high","summary":"The All In One Login WordPress plugin before 2.5.0 does not limit guesses against the short numeric code used for its default passwordless email login. Failed attempts are also not counted by its brute-force protection, so an unauthenticated attacker can guess the code and log in as any account, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","all-in-one-login"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker logs in as any user, including administrators, and takes over the site.","analyst_note":"Sources give no severity, exact fixed version or vendor advisory; confirm the fixed version in the NVD range and check the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or in `wp-content/plugins/` for the All In One Login plugin; versions below `2.5.0` are in scope.\n- Check whether the passwordless email login feature is enabled in the plugin settings (the sources say it is enabled by default).","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-updated","passwordless-login-disabled"],"who_is_affected":"Any WordPress site running the All In One Login plugin before 2.5.0 with its default passwordless email login enabled is exposed, because the login code can be guessed without limit. Sites that have removed the plugin or disabled the passwordless email login are not affected by this path. Teams that run WordPress for clients should check every site they manage.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000756,"input_tokens":4223,"output_tokens":667,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-19256':16A,19A '-2026':15A,18A '2.5.0':38B,91C 'account':12A,80B,139C 'adequ':94C 'admin':11A 'administr':82B,141C 'all-in-one-login':20B 'allow':10A,132C 'also':58B 'attack':70B,134C 'attempt':56B,99C,124C 'brute':64B,129C 'brute-forc':63B,128C 'code':8A,47B,74B,108C 'count':60B 'cve':14A,17A 'default':51B,113C 'default-en':112C 'email':53B,116C 'enabl':114C 'fail':55B,123C 'feed':121C 'forc':65B,130C 'guess':42B,72B 'host':28B 'includ':81B,140C 'limit':9A,41B 'log':76B 'login':5A,24B,34B,54B,87C,117C 'made':103C 'number':97C 'numer':46B,107C 'one':4A,23B,33B,86C 'packag':25B 'passwordless':52B,115C 'plugin':6A,36B,89C 'protect':66B,131C 'restrict':95C 'self':27B 'self-host':26B 'short':45B,106C 'take':136C 'takeov':13A 'unauthent':69B,133C 'use':48B,109C 'weak':7A 'wordpress':1A,29B,35B,88C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the All In One Login plugin before 2.5.0 with its default passwordless email login enabled is exposed, because the login code can be guessed without limit. Sites that have removed the plugin or disabled the passwordless email login are not affected by this path. Teams that run WordPress for clients should check every site they manage.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["allinonelogin","critical","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19256","severity":null,"published_at":"2026-11-05T06:17:08+00:00","modified_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}