CVE-2026-19256: Account Takeover in All In One Login

All In One Login <2.5.0: brute force on OTP allows unauthenticated account takeover. CVSS 9.8

CVE-2026-19256 identifies a critical vulnerability in the WordPress All In One Login plugin that enables unauthorized account takeover. The flaw lies in the passwordless login mechanism using short numeric OTP codes sent via email: the plugin does not adequately limit brute force attempts against the code and does not integrate brute-force protection. Unauthenticated attackers can compromise any account, including WordPress administrators.

The vulnerability carries a CVSS score of 9.8, classified as Critical. It was confirmed and published on NVD on 2026-11-05. The All In One Login plugin is popular among WordPress administrators for simplified authentication. Technical media signals (last 24 hours) confirm community attention to the flaw, but no confirmed public exploits have been reported. The official patch was released with version 2.5.0.

WordPress administrators must immediately update All In One Login to version 2.5.0 or later. Before updating, review access logs to identify any unauthorized administrator account access. If the plugin is critical, consider temporarily disabling it until the update is complete. Monitor SIEM systems for brute force patterns against WordPress accounts during the vulnerability window.

At a glance

What: The WordPress All In One Login plugin before version 2.5.0 does not adequately limit brute force attempts against the short numeric code used by its passwordless email login. It does not integrate brute-force protection, allowing unauthenticated attackers to take over any WordPress account, including administrators.
Severity: CVSS 9.8 (Critical). Critical vulnerability allowing unauthorized account acquisition without prior authentication.
Affected versions: All In One Login versions 2.4.0 and earlier through 2.5.0 (excluded). Fixed version: 2.5.0 and later.
Fix: Update the All In One Login plugin to version 2.5.0 or later. The fix has been officially released.
Status: Vulnerability confirmed by NVD on 2026-11-05. Patch released. No confirmed public exploits reported at time of publication.
Action: WordPress administrators must immediately update All In One Login to 2.5.0+. Verify no accounts have been compromised in access logs. Disable the plugin pending update if critical to service.

Sources: NVD, CVE-2026-19256

← All articles