{
 "id": "WPSEC-2026-1734",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1734/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1734/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1734/index.md",
 "title": "All-In-One Security (AIOS) – Security and Firewall <= 5.4.10 - Unauthenticated Login Lockout Bypass via Empty 'aiowps_auth_key' Parameter",
 "description": "The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to a login lockout bypass via the unlock request feature in all versions up to, and including, 5.4.10, due to the 'aiowps_auth_key' handler accepting an empty value and passing it to process_unlock_request(), which releases every lockout whose stored unlock key matches. Lockouts for which no unlock key was ever issued keep the default empty unlock key, so they match. This makes it possible for unauthenticated attackers to clear login lockouts, including the one on their own IP address, and so get around the brute force login lockout protection and keep guessing passwords.",
 "plugin": {
  "slug": "all-in-one-wp-security-and-firewall",
  "name": "All-In-One Security (AIOS) – Security and Firewall",
  "full_name": "All-In-One Security (AIOS) – Security and Firewall",
  "wordpress_org": "https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/",
  "advisories_url": "https://wpsec.com/vuln/plugin/all-in-one-wp-security-and-firewall/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/all-in-one-wp-security-and-firewall"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-693"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.5.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.5.0",
 "remediation": "Update to 5.5.0 or later.",
 "fix_released": "2026-10-26T13:09:52+00:00",
 "published": "2026-10-27T13:53:32+00:00",
 "updated": "2026-10-27T13:38:23.453740+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1734/",
  "https://plugins.svn.wordpress.org/all-in-one-wp-security-and-firewall/tags/5.5.0/",
  "https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/all-in-one-wp-security-and-firewall",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-27"
 }
}