All-In-One Security (AIOS) – Security and Firewall <= 5.4.9 - Unauthenticated Login Lockout Bypass via Unlock Request
- ID
- WPSEC-2026-0198
- Plugin
- All-In-One Security (AIOS) – Security and Firewall (all-in-one-wp-security-and-firewall)
- Affected
- all versions before 5.4.10
- Remediation
- Update to 5.4.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- All-In-One Security (AIOS) – Security and Firewall on WPSec AttackSurface
- Fix released
- Published
Description
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to a login lockout bypass via the unlock request feature in all versions up to, and including, 5.4.9. This is due to the generate_unlock_request_link() function writing the emailed unlock key onto every active lockout entry whose IP address matches the requester's IP, without checking which user account the lockout was recorded for. This makes it possible for unauthenticated attackers who control the email address of any registered account, and who share an IP address with an active lockout, to clear lockouts recorded for other accounts and resume login attempts, weakening the plugin's brute-force protection when the login lockout feature is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0198/
- https://plugins.svn.wordpress.org/all-in-one-wp-security-and-firewall/tags/5.4.10/
- https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS