blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-19256

CRITICAL 9.8 CVSS 3.1
Published
November 5, 2026
Last modified
November 6, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-269
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.

Affected products and versions

  • Unknown All In One Login — From 2.4.0 (including) to 2.5.0 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/576162c1-324f-4618-b167-c05e37f50c74/
  • nvd.nist.gov Official NVD record