{"affected":[{"defaultStatus":"unaffected","product":"All In One Login","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.5.0","status":"affected","version":"2.4.0","versionType":"semver"}]}],"cveId":"CVE-2026-19256","cwes":["CWE-269"],"description":"The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/576162c1-324f-4618-b167-c05e37f50c74/"}],"kev":null,"metrics":[],"modifiedAt":1793858423724,"publishedAt":1793858423724,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/576162c1-324f-4618-b167-c05e37f50c74/"}],"remediation":[],"revision":"b8a1b8e9fe342e338d8c1c821c22c0f34b387d68a579505658d70ca23c19ab3b","sources":[{"modifiedAt":1793858423724,"name":"CNA: WPScan","retrievedAt":1793858993828,"url":"https://www.cve.org/CVERecord?id=CVE-2026-19256"}],"ssvc":null,"status":"published","title":"All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force","updatedAt":1793858993828}