All In One Login WordPress plugin email code brute force allows account takeover
Attackers can take over any WordPress account, admins included!
Summary
The All In One Login plugin versions 2.4.0 to 2.4.1 do not limit attempts against the email login code, so an unauthenticated attacker can take over any account, including administrators. Sites using the default-enabled email login are affected.
Affected when
- passwordless email login enabled (on by default)
What to do
Update to version 2.5.0.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
Times
First published
First seen