CVE-2026-19256: All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force

Published Nov 5, 2026

Updated

The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade All In One Login to a version that resolves this vulnerability.
Fixed in 2.5.0

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which sites are exposed to takeover attempts?

Sites using All In One Login versions before 2.5.0 are exposed when the plugin's default-enabled passwordless email login is available. Any account, including administrator accounts, may be targeted.

What does an attacker need to exploit this issue?

The attacker does not need to authenticate. They can repeatedly guess the short numeric email OTP because failed OTP attempts are not adequately limited or counted by the plugin's brute-force protection.

Does the plugin's brute-force protection mitigate these OTP guesses?

No. Failed passwordless email OTP attempts are not fed into the plugin's own brute-force protection, so that protection does not prevent the described attack path.

What should be done if immediate patching is not possible?

The provided information identifies the default-enabled passwordless email login as the affected feature. Disabling that feature can remove the described OTP brute-force attack path until the plugin can be updated to version 2.5.0 or later.

CVE-2026-19256: All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force

Remediation

Event History

Frequently Asked Questions

Which sites are exposed to takeover attempts?

What does an attacker need to exploit this issue?

Does the plugin's brute-force protection mitigate these OTP guesses?

What should be done if immediate patching is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to takeover attempts?

What does an attacker need to exploit this issue?

Does the plugin's brute-force protection mitigate these OTP guesses?

What should be done if immediate patching is not possible?