All-In-One Security (AIOS) – Security and Firewall <= 5.4.10 - Unauthenticated Login Lockout Bypass via Empty 'aiowps_auth_key' Parameter
- ID
- WPSEC-2026-1734
- Plugin
- All-In-One Security (AIOS) – Security and Firewall (all-in-one-wp-security-and-firewall)
- Affected
- all versions before 5.5.0
- Remediation
- Update to 5.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- All-In-One Security (AIOS) – Security and Firewall on WPSec AttackSurface
- Fix released
- Published
Description
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to a login lockout bypass via the unlock request feature in all versions up to, and including, 5.4.10, due to the 'aiowps_auth_key' handler accepting an empty value and passing it to process_unlock_request(), which releases every lockout whose stored unlock key matches. Lockouts for which no unlock key was ever issued keep the default empty unlock key, so they match. This makes it possible for unauthenticated attackers to clear login lockouts, including the one on their own IP address, and so get around the brute force login lockout protection and keep guessing passwords.
References
- https://wpsec.com/vuln/WPSEC-2026-1734/
- https://plugins.svn.wordpress.org/all-in-one-wp-security-and-firewall/tags/5.5.0/
- https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS