CVE-2026-19256

— UNSCORED

Published 2026-11-05 · Updated 2026-11-05

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.

All references

https://wpscan.com/vulnerability/576162c1-324f-4618-b167-c05e37f50c74/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.