# All-In-One Security (AIOS) – Security and Firewall <= 5.4.10 - Unauthenticated Login Lockout Bypass via Empty 'aiowps_auth_key' Parameter

- **ID:** WPSEC-2026-1734
- **Plugin:** All-In-One Security (AIOS) – Security and Firewall (`all-in-one-wp-security-and-firewall`), https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/
- **Affected versions:** all versions before 5.5.0
- **Fixed in:** 5.5.0 (Update to 5.5.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-693
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/all-in-one-wp-security-and-firewall
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1734/

## Description

The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to a login lockout bypass via the unlock request feature in all versions up to, and including, 5.4.10, due to the 'aiowps_auth_key' handler accepting an empty value and passing it to process_unlock_request(), which releases every lockout whose stored unlock key matches. Lockouts for which no unlock key was ever issued keep the default empty unlock key, so they match. This makes it possible for unauthenticated attackers to clear login lockouts, including the one on their own IP address, and so get around the brute force login lockout protection and keep guessing passwords.

## References

- https://wpsec.com/vuln/WPSEC-2026-1734/
- https://plugins.svn.wordpress.org/all-in-one-wp-security-and-firewall/tags/5.5.0/
- https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1734/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.