CVE-2026-19256 All In One Login CVE debrief

Who should care

Defenders responsible for WordPress installations using the All In One Login plugin should assess exposure and prioritize verification and potential remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and evaluate the need for additional brute-force protection measures.

Why it matters

CVE-2026-19256 allows unauthenticated attackers to take over any account, including administrators, due to inadequate restrictions on passwordless email login in the All In One Login WordPress plugin. Defenders should prioritize verifying exposure and assessing the need for additional brute-force protection measures.

• Unauthenticated attackers can take over any account, including administrators
• Additional brute-force protection measures may be necessary
• Verification of exposure and remediation is required

Technical summary

The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection. This allows unauthenticated attackers to take over any account, including administrators, by exploiting the vulnerability. Defenders should prioritize verifying exposure of WordPress installations using the All In One Login plugin and assess the need for additional brute-force protection measures.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the All In One Login plugin and assess the need for additional brute-force protection measures.

Recommended defensive actions

• Verify WordPress installations using the All In One Login plugin and assess exposure
• Evaluate the need for additional brute-force protection measures
• Monitor for attempts to exploit this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. Defenders should verify WordPress installations using the All In One Login plugin, assess exposure, and evaluate the need for additional brute-force protection measures. The short numeric code used by the default-enabled passwordless email login is vulnerable to brute-force attacks. Evidence is limited, and defenders should exercise caution when verifying exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.