Email OTP brute force in All In One Login allows account takeover
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-269.
Summary
The All In One Login WordPress plugin from 2.4.0 before 2.5.0 is affected. It does not limit guesses against the short numeric code of its default-enabled passwordless email login and does not count failed attempts toward its brute-force protection (CWE-269). An unauthenticated remote attacker can guess the code and take over any account, including administrators. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | All In One Login | 2.4.0 to before 2.5.0 | 2.5.0 | Patch available | CNA |
- All In One Login VendorUnknown Affected 2.4.0 to before 2.5.0 Fixed in 2.5.0 Patch available CNA
Remediation
Upgrade All In One Login to version 2.5.0.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA All In One Login (Unknown) Fixed in 2.5.0
Timeline
- 2026-11-05 Threatist record created from CVE-2026-19256
- 2026-11-05 Alias added: GHSA-j2j9-q63m-9wvj
- 2026-11-06 CVSS score added · CISA ADP
- 2026-11-06 Weakness changed · CISA ADP
- 2026-11-06 CISA SSVC decision points changed
- 2026-11-06 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-19256 · CVE Program
- CVE-2026-19256 · NVD
- FIRST EPSS
- GHSA-j2j9-q63m-9wvj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences