CVE-2026-19256 in All In One Login Plugin
Summary
by MITRE • 11/05/2026
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in All In One Login versions prior to 2.5.0 represents a critical authentication bypass flaw rooted in the implementation of passwordless email login functionality. This feature allows users to log into WordPress sites by entering an email address and receiving a short numeric code via email, which is then entered on the site for verification. While this method offers convenience, it introduces specific attack vectors if not properly secured against automated abuse. In the affected versions, the plugin fails to implement adequate rate limiting or account lockout mechanisms specifically targeting these one-time codes. Consequently, an unauthenticated attacker can submit a high volume of requests attempting different numeric codes without triggering any defensive measures within the application logic.
From a technical perspective, the core issue lies in the absence of brute-force protection for this specific authentication flow. Most modern web applications employ strategies such as exponential backoff, temporary account suspension after multiple failures, or CAPTCHA challenges to mitigate credential stuffing and guessing attacks. The All In One Login plugin neglected to integrate these failed attempts into its existing security framework. This oversight means that the system treats each login attempt with a numeric code as an independent event rather than part of a potential attack pattern. As a result, attackers can utilize automated scripts to iterate through all possible combinations for short numeric codes at high speeds, effectively bypassing any intended security controls designed to prevent unauthorized access.
The operational impact of this vulnerability is severe due to the nature of WordPress ecosystems and the privileges associated with administrative accounts. Since there are no restrictions on the number of attempts, an attacker can perform a brute-force attack against any user account, including those with administrator-level permissions. Given that short numeric codes typically have limited entropy—for example, a four-digit code offers only ten thousand possibilities—the time required to guess the correct code is minimal when automated tools are employed. Successful exploitation allows attackers to gain full control over compromised accounts without needing valid passwords or two-factor authentication tokens beyond the email access, which may be easier to compromise through other means such as phishing or credential leaks from unrelated breaches.
This vulnerability aligns with CWE-307 Improper Restriction of Excessive Authentication Attempts and is categorized under MITRE ATT&CK technique T1110 Brute Force. The lack of rate limiting specifically for the passwordless login mechanism creates a significant gap in defense-in-depth strategies commonly expected from security plugins. Organizations relying on this plugin are exposed to unauthorized access, data exfiltration, defacement, and potential further compromise of the underlying server infrastructure if administrative privileges are obtained.
To mitigate this risk, immediate action is required by upgrading the All In One Login plugin to version 2.5.0 or later where these restrictions have been addressed. Administrators should also consider implementing additional layers of security such as Web Application Firewalls that can detect and block abnormal traffic patterns associated with brute-force attacks at the network level. Furthermore, enabling CAPTCHA challenges for login forms and ensuring that email services used for delivering codes are secured against unauthorized access adds robustness to the authentication process. Regular audits of plugin configurations and adherence to industry standards like OWASP Authentication Cheat Sheet guidelines can help prevent similar vulnerabilities in future deployments.