{"id":"CVE-2026-19256","published":"2026-11-05T06:17:08.240","lastModified":"2026-11-05T06:17:08.240","description":"The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/576162c1-324f-4618-b167-c05e37f50c74/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}