Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🆕 New CVE All In One Login: admin account takeover in passwordless email login (CVE-2026-19256) Unauthenticated attackers can guess the short login code and take over any account, including administrators. Patch → 2.5.0 https://cve.now/CVE-2026-19256?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
New WordPress plugin flaw (CVE-2026-19256): All In One Login before 2.5.0. Its default Email OTP uses a short code with weak attempt limits — unauthenticated attackers can take over any account, including admins. Update to 2.5.0+ if you run it.
🆕 New CVE: CVE-2026-19256 (CVSS 9.8, Enclave score 7/10) All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force Remote, no login needed. The All In One Login WordPress plugin before 2.5.0 does not adequately… https://app.enclave.ai/threat-feed/CVE-2026-19256